@@ 1,59 0,0 @@
-Fix CVE-2017-1000369:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369
-https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
-
-Patch adapted from upstream source repository:
-
-https://git.exim.org/exim.git/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21
-
-From 65e061b76867a9ea7aeeb535341b790b90ae6c21 Mon Sep 17 00:00:00 2001
-From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de>
-Date: Wed, 31 May 2017 23:08:56 +0200
-Subject: [PATCH] Cleanup (prevent repeated use of -p/-oMr to avoid mem leak)
-
----
- doc/doc-docbook/spec.xfpt |  3 ++-
- src/src/exim.c            | 19 +++++++++++++++++--
- 2 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/src/src/exim.c b/src/src/exim.c
-index 67583e58..88e11977 100644
---- a/src/exim.c
-+++ b/src/exim.c
-@@ -3106,7 +3106,14 @@ for (i = 1; i < argc; i++)
- 
-       /* -oMr: Received protocol */
- 
--      else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
-+      else if (Ustrcmp(argrest, "Mr") == 0)
-+
-+        if (received_protocol)
-+          {
-+          fprintf(stderr, "received_protocol is set already\n");
-+          exit(EXIT_FAILURE);
-+          }
-+        else received_protocol = argv[++i];
- 
-       /* -oMs: Set sender host name */
- 
-@@ -3202,7 +3209,15 @@ for (i = 1; i < argc; i++)
- 
-     if (*argrest != 0)
-       {
--      uschar *hn = Ustrchr(argrest, ':');
-+      uschar *hn;
-+
-+      if (received_protocol)
-+        {
-+        fprintf(stderr, "received_protocol is set already\n");
-+        exit(EXIT_FAILURE);
-+        }
-+
-+      hn = Ustrchr(argrest, ':');
-       if (hn == NULL)
-         {
-         received_protocol = argrest;
--- 
-2.13.1
-


@@ 1,65 0,0 @@
-Fix CVE-2017-16943:
-
-https://bugs.exim.org/show_bug.cgi?id=2199
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16943
-
-Patch copied from upstream source repository:
-
-https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde
-
-From 4090d62a4b25782129cc1643596dc2f6e8f63bde Mon Sep 17 00:00:00 2001
-From: Jeremy Harris <jgh146exb@wizmail.org>
-Date: Fri, 24 Nov 2017 20:22:33 +0000
-Subject: [PATCH] Avoid release of store if there have been later allocations. 
- Bug 2199
-
----
- doc/doc-txt/ChangeLog | 4 ++++
- src/src/receive.c     | 7 ++++---
- 2 files changed, 8 insertions(+), 3 deletions(-)
-
-#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
-#index e937ba2..a2d9339 100644
-#--- a/doc/doc-txt/ChangeLog
-#+++ b/doc/doc-txt/ChangeLog
-#@@ -59,6 +59,10 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for
-#       connection in response to HELO" was logged instead of the actual 4xx
-#       error for the HELO.
-# 
-#+JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.
-#+      A crafted sequence of BDAT commands could result in in-use memory beeing
-#+      freed.
-#+
-# 
- Exim version 4.89
- -----------------
-diff --git a/src/src/receive.c b/src/src/receive.c
-index 95cf13e..20672db 100644
---- a/src/receive.c
-+++ b/src/receive.c
-@@ -1772,8 +1772,8 @@ for (;;)
-   (and sometimes lunatic messages can have ones that are 100s of K long) we
-   call store_release() for strings that have been copied - if the string is at
-   the start of a block (and therefore the only thing in it, because we aren't
--  doing any other gets), the block gets freed. We can only do this because we
--  know there are no other calls to store_get() going on. */
-+  doing any other gets), the block gets freed. We can only do this release if
-+  there were no allocations since the once that we want to free. */
- 
-   if (ptr >= header_size - 4)
-     {
-@@ -1782,9 +1782,10 @@ for (;;)
-     header_size *= 2;
-     if (!store_extend(next->text, oldsize, header_size))
-       {
-+      BOOL release_ok = store_last_get[store_pool] == next->text;
-       uschar *newtext = store_get(header_size);
-       memcpy(newtext, next->text, ptr);
--      store_release(next->text);
-+      if (release_ok) store_release(next->text);
-       next->text = newtext;
-       }
-     }
--- 
-1.9.1
-


@@ 1,87 0,0 @@
-Fix CVE-2017-16944:
-
-https://bugs.exim.org/show_bug.cgi?id=2201
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16944
-
-Patch copied from upstream source repository:
-
-https://git.exim.org/exim.git/commit/4804c62909a62a3ac12ec4777ebd48c541028965
-
-From 4804c62909a62a3ac12ec4777ebd48c541028965 Mon Sep 17 00:00:00 2001
-From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de>
-Date: Mon, 27 Nov 2017 22:42:33 +0100
-Subject: [PATCH] Chunking: do not treat the first lonely dot special.
- CVE-2017-16944, Bug 2201
-
-(cherry picked from commit 178ecb70987f024f0e775d87c2f8b2cf587dd542)
-
-Change log update
-
-(cherry picked from commit b488395f4d99d44a950073a64b35ec8729102782)
----
- doc/doc-txt/ChangeLog | 6 +++++-
- src/src/receive.c     | 2 +-
- src/src/smtp_in.c     | 7 +++++++
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
-#index a2d9339..541ebaf 100644
-#--- a/doc/doc-txt/ChangeLog
-#+++ b/doc/doc-txt/ChangeLog
-#@@ -61,7 +61,11 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for
-# 
-# JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.
-#       A crafted sequence of BDAT commands could result in in-use memory beeing
-#-      freed.
-#+      freed.  CVE-2017-16943.
-#+
-#+HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading
-#+      from SMTP input.  Previously it was always done; now only done for DATA
-#+      and not BDAT commands.  CVE-2017-16944.
-# 
-# 
-# Exim version 4.89
-diff --git a/src/src/receive.c b/src/src/receive.c
-index 20672db..2812ea2 100644
---- a/src/receive.c
-+++ b/src/receive.c
-@@ -1827,7 +1827,7 @@ for (;;)
-   prevent further reading), and break out of the loop, having freed the
-   empty header, and set next = NULL to indicate no data line. */
- 
--  if (ptr == 0 && ch == '.' && (smtp_input || dot_ends))
-+  if (ptr == 0 && ch == '.' && dot_ends)
-     {
-     ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
-     if (ch == '\r')
-diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
-index 1b45f84..0207540 100644
---- a/src/smtp_in.c
-+++ b/src/smtp_in.c
-@@ -4955,16 +4955,23 @@ while (done <= 0)
-       DEBUG(D_receive) debug_printf("chunking state %d, %d bytes\n",
- 				    (int)chunking_state, chunking_data_left);
- 
-+      /* push the current receive_* function on the "stack", and
-+      replace them by bdat_getc(), which in turn will use the lwr_receive_*
-+      functions to do the dirty work. */
-       lwr_receive_getc = receive_getc;
-       lwr_receive_ungetc = receive_ungetc;
-+
-       receive_getc = bdat_getc;
-       receive_ungetc = bdat_ungetc;
- 
-+      dot_ends = FALSE;
-+
-       goto DATA_BDAT;
-       }
- 
-     case DATA_CMD:
-     HAD(SCH_DATA);
-+    dot_ends = TRUE;
- 
-     DATA_BDAT:		/* Common code for DATA and BDAT */
-     if (!discarded && recipients_count <= 0)
--- 
-1.9.1
-