Added integer overflow check for SPF macro segment count.

mpkleine · Jan 15, 2022 · 186a601 · 186a601
1 parent a715fb3
commit 186a601
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/hmailserver/source/Server/SMTP/SPF/RMSPF.cpp b/hmailserver/source/Server/SMTP/SPF/RMSPF.cpp
@@ -13,6 +13,7 @@
 #undef UNICODE
 
 #include <windns.h>
+#include <limits.h>
 #include <string.h>
 #include <stdlib.h>
 #include <time.h>
@@ -2371,7 +2372,9 @@ char** bufp, spfbool fordomain)
          // get max number of parts
          num = 0;
          while (ISDIGIT(*cp))
-         {
+            if (num > (INT_MAX - (*cp - '0')) / 10)
+                return SPF_PermError;
+
             num = num * 10 + *cp - '0';
             if (++cp >= s1)
                return SPF_PermError;