CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/07/12 17:30:54
Modified files:
usr.sbin/smtpd : mda_mbox.c
Log message:
reject empty or slash-bearing usernames before building the mbox path
mda_mbox_init() builds _PATH_MAILDIR/username and creates and chowns it as
root. the username comes from K_USERINFO table data, which is not checked
for slashes, so a dynamic userbase returning a slashed username could make
root create a path outside the mailbox namespace. in practice, it does not
affect default userbase which goes through getpwnam(), and it requires the
admin to voluntarily create a badly crafted username in the userbase.
from Andrew Griffiths (fixed by me), ok op@
