CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/07/12 17:24:47
Modified files:
usr.sbin/smtpd : enqueue.c
Log message:
reject CR and LF in argv-derived fields before starting the SMTP dialogue
enqueue interpolates the sender, recipients and DSN options straight into
MAIL FROM / RCPT TO command lines. an embedded CR or LF split the command
boundary and injected additional SMTP commands over the local session, so
refuse any such field up front.
from Andrew Griffiths (fixed by me), ok op@
