mail-mta/exim: revbumps for use-after-free fixes, CVE-2022-3559, cleanup

Bug: https://bugs.gentoo.org/877607
Signed-off-by: Fabian Groffen <grobian@gentoo.org>

5 files changed, 141 insertions, 24 deletions

diff --git a/mail-mta/exim/exim-4.94.2-r7.ebuild b/mail-mta/exim/exim-4.94.2-r7.ebuild
index 4d949c4c4c01..2c3b5101c59f 100644
--- a/mail-mta/exim/exim-4.94.2-r7.ebuild
+++ b/mail-mta/exim/exim-4.94.2-r7.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="7"
 
-inherit db-use toolchain-funcs multilib pam systemd
+inherit db-use toolchain-funcs pam systemd
 
 IUSE="arc +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl dsn exiscan-acl gnutls idn ipv6 ldap lmtp maildir mbx mysql nis pam perl pkcs11 postgres +prdr proxy radius redis sasl selinux spf sqlite srs +srs-alt srs-native +ssl syslog tcpd +tpda X"
 REQUIRED_USE="
@@ -89,18 +89,13 @@ DEPEND="${COMMON_DEPEND}"
 RDEPEND="${COMMON_DEPEND}
 	!mail-mta/courier
 	!mail-mta/esmtp
-	!mail-mta/mini-qmail
-	!<mail-mta/msmtp-1.4.19-r1
-	!>=mail-mta/msmtp-1.4.19-r1[mta]
+	!mail-mta/msmtp[mta]
 	!mail-mta/netqmail
 	!mail-mta/nullmailer
 	!mail-mta/postfix
-	!mail-mta/qmail-ldap
 	!mail-mta/sendmail
 	!mail-mta/opensmtpd
-	!<mail-mta/ssmtp-2.64-r2
-	!>=mail-mta/ssmtp-2.64-r2[mta]
-	!net-mail/mailwrapper
+	!mail-mta/ssmtp[mta]
 	>=net-mail/mailbase-0.00-r5
 	virtual/logger
 	dcc? ( mail-filter/dcc )
diff --git a/mail-mta/exim/exim-4.94.2-r8.ebuild b/mail-mta/exim/exim-4.94.2-r9.ebuild
index 7cce1a0a02e3..c62c296b2534 100644
--- a/mail-mta/exim/exim-4.94.2-r8.ebuild
+++ b/mail-mta/exim/exim-4.94.2-r9.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="7"
 
-inherit db-use toolchain-funcs multilib pam systemd
+inherit db-use toolchain-funcs pam systemd
 
 IUSE="arc berkdb +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl
 dsn exiscan-acl gdbm gnutls idn ipv6 ldap lmtp maildir mbx
@@ -97,18 +97,13 @@ DEPEND="${COMMON_DEPEND}"
 RDEPEND="${COMMON_DEPEND}
 	!mail-mta/courier
 	!mail-mta/esmtp
-	!mail-mta/mini-qmail
-	!<mail-mta/msmtp-1.4.19-r1
-	!>=mail-mta/msmtp-1.4.19-r1[mta]
+	!mail-mta/msmtp[mta]
 	!mail-mta/netqmail
 	!mail-mta/nullmailer
 	!mail-mta/postfix
-	!mail-mta/qmail-ldap
 	!mail-mta/sendmail
 	!mail-mta/opensmtpd
-	!<mail-mta/ssmtp-2.64-r2
-	!>=mail-mta/ssmtp-2.64-r2[mta]
-	!net-mail/mailwrapper
+	!mail-mta/ssmtp[mta]
 	>=net-mail/mailbase-0.00-r5
 	virtual/logger
 	dcc? ( mail-filter/dcc )
@@ -126,6 +121,7 @@ src_prepare() {
 	eapply     "${FILESDIR}"/exim-4.69-r1.27021.patch
 	eapply     "${FILESDIR}"/exim-4.94-localscan_dlopen.patch
 	eapply     "${FILESDIR}"/exim-4.94.2-fix-crash-resolve.patch # 799368 upstr
+	eapply     "${FILESDIR}"/exim-4.94-CVE-2022-3559.patch  # 877607 upstr
 
 	# for this reason we have a := dep on opendmarc, they changed their
 	# API in a minor release
diff --git a/mail-mta/exim/exim-4.96-r1.ebuild b/mail-mta/exim/exim-4.96-r2.ebuild
index 719ead900410..739a2fcdea96 100644
--- a/mail-mta/exim/exim-4.96-r1.ebuild
+++ b/mail-mta/exim/exim-4.96-r2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="7"
 
-inherit db-use toolchain-funcs multilib pam systemd
+inherit db-use toolchain-funcs pam systemd
 
 IUSE="arc berkdb +dane dcc +dkim dlfunc dmarc +dnsdb doc dovecot-sasl
 dsn exiscan-acl gdbm gnutls idn ipv6 ldap lmtp maildir mbx
@@ -93,18 +93,13 @@ DEPEND="${COMMON_DEPEND}"
 RDEPEND="${COMMON_DEPEND}
 	!mail-mta/courier
 	!mail-mta/esmtp
-	!mail-mta/mini-qmail
-	!<mail-mta/msmtp-1.4.19-r1
-	!>=mail-mta/msmtp-1.4.19-r1[mta]
+	!mail-mta/msmtp[mta]
 	!mail-mta/netqmail
 	!mail-mta/nullmailer
 	!mail-mta/postfix
-	!mail-mta/qmail-ldap
 	!mail-mta/sendmail
 	!mail-mta/opensmtpd
-	!<mail-mta/ssmtp-2.64-r2
-	!>=mail-mta/ssmtp-2.64-r2[mta]
-	!net-mail/mailwrapper
+	!mail-mta/ssmtp[mta]
 	>=net-mail/mailbase-0.00-r5
 	virtual/logger
 	dcc? ( mail-filter/dcc )
@@ -121,6 +116,7 @@ src_prepare() {
 	eapply -p0 "${FILESDIR}"/exim-4.76-crosscompile.patch # 266591
 	eapply     "${FILESDIR}"/exim-4.69-r1.27021.patch
 	eapply     "${FILESDIR}"/exim-4.95-localscan_dlopen.patch
+	eapply -p2 "${FILESDIR}"/exim-4.96-dmarc_use_after_free.patch # upstr
 
 	# oddity, they disable berkdb as hack, and then throw an error when
 	# berkdb isn't enabled
diff --git a/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch b/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch
new file mode 100644
index 000000000000..9617c70d9e57
--- /dev/null
+++ b/mail-mta/exim/files/exim-4.94-CVE-2022-3559.patch
@@ -0,0 +1,99 @@
+Patch cleaned up for Gentoo
+- applied to 4.94
+- removed unnecessary whitespace changes
+
+From 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2 Mon Sep 17 00:00:00 2001
+From: Jeremy Harris <jgh146exb@wizmail.org>
+Date: Wed, 31 Aug 2022 15:37:40 +0100
+Subject: [PATCH 1/1] Fix $regex<n> use-after-free.  Bug 2915
+
+--- exim-4.94.2/src/exim.c	2021-04-30 14:08:21.000000000 +0200
++++ exim-4.94.2/src/exim.c	2022-10-19 09:15:58.611447982 +0200
+@@ -1886,8 +1886,6 @@
+   regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
+ #endif
+ 
+-for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
+-
+ /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
+ this seems to be a generally accepted convention, since one finds symbolic
+ links called "mailq" in standard OS configurations. */
+@@ -5841,7 +5839,7 @@
+   deliver_localpart_data = deliver_domain_data =
+   recipient_data = sender_data = NULL;
+   acl_var_m = NULL;
+-  for(int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
++  regex_vars_clear();
+ 
+   store_reset(reset_point);
+   }
+--- exim-4.94.2/src/functions.h	2021-04-30 14:08:21.000000000 +0200
++++ exim-4.94.2/src/functions.h	2022-10-19 09:17:44.882122667 +0200
+@@ -417,6 +417,7 @@
+ #endif
+ extern BOOL    regex_match_and_setup(const pcre *, const uschar *, int, int);
+ extern const pcre *regex_must_compile(const uschar *, BOOL, BOOL);
++extern void    regex_vars_clear(void);
+ extern void    retry_add_item(address_item *, uschar *, int);
+ extern BOOL    retry_check_address(const uschar *, host_item *, uschar *, BOOL,
+                  uschar **, uschar **);
+--- exim-4.94.2/src/globals.c	2022-10-19 09:14:19.344751853 +0200
++++ exim-4.94.2/src/globals.c	2022-10-19 09:18:27.675991666 +0200
+@@ -1289,7 +1289,7 @@
+ #endif
+ const pcre *regex_ismsgid      = NULL;
+ const pcre *regex_smtp_code    = NULL;
+-uschar *regex_vars[REGEX_VARS];
++uschar *regex_vars[REGEX_VARS] = { 0 };
+ #ifdef WHITELIST_D_MACROS
+ const pcre *regex_whitelisted_macro = NULL;
+ #endif
+--- exim-4.94.2/src/regex.c	2021-04-30 14:08:21.000000000 +0200
++++ exim-4.94.2/src/regex.c	2022-10-19 09:35:03.229084750 +0200
+@@ -87,6 +87,14 @@
+ return FAIL;
+ }
+ 
++/* reset expansion variables */
++void
++regex_vars_clear(void)
++{
++regex_match_string = NULL;
++for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
++}
++
+ int
+ regex(const uschar **listptr)
+ {
+@@ -98,7 +106,7 @@
+ int ret = FAIL;
+ 
+ /* reset expansion variable */
+-regex_match_string = NULL;
++regex_vars_clear();
+ 
+ if (!mime_stream)				/* We are in the DATA ACL */
+   {
+@@ -166,8 +174,7 @@
+ int mime_subject_len = 0;
+ int ret;
+ 
+-/* reset expansion variable */
+-regex_match_string = NULL;
++regex_vars_clear();
+ 
+ /* precompile our regexes */
+ if (!(re_list_head = compile(*listptr)))
+--- exim-4.94.2/src/smtp_in.c	2021-04-30 14:08:21.000000000 +0200
++++ exim-4.94.2/src/smtp_in.c	2022-10-19 09:15:58.613447975 +0200
+@@ -2161,8 +2161,10 @@
+ #ifdef SUPPORT_I18N
+ message_smtputf8 = FALSE;
+ #endif
++regex_vars_clear();
+ body_linecount = body_zerocount = 0;
+ 
++lookup_value = NULL;				/* Can be set by ACL */
+ sender_rate = sender_rate_limit = sender_rate_period = NULL;
+ ratelimiters_mail = NULL;           /* Updated by ratelimit ACL condition */
+                    /* Note that ratelimiters_conn persists across resets. */
diff --git a/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch b/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch
new file mode 100644
index 000000000000..dc2f62e9ba0f
--- /dev/null
+++ b/mail-mta/exim/files/exim-4.96-dmarc_use_after_free.patch
@@ -0,0 +1,31 @@
+From 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445 Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@brun.one>
+Date: Fri, 14 Oct 2022 21:02:51 +0200
+Subject: [PATCH] DMARC: fix use-after-free in dmarc_dns_lookup
+
+This fixes a use-after-free in dmarc_dns_lookup where the result
+of dns_lookup in dnsa is freed before the required data is copied out.
+
+Fixes: 9258363 ("DNS: explicit alloc/free of workspace")
+---
+ src/src/dmarc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/src/dmarc.c b/src/src/dmarc.c
+index ad0c26c91..53c2752ac 100644
+--- a/src/src/dmarc.c
++++ b/src/src/dmarc.c
+@@ -230,8 +230,9 @@ if (rc == DNS_SUCCEED)
+        rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+     if (rr->type == T_TXT && rr->size > 3)
+       {
++      uschar *record = string_copyn_taint(US rr->data, rr->size, GET_TAINTED);
+       store_free_dns_answer(dnsa);
+-      return string_copyn_taint(US rr->data, rr->size, GET_TAINTED);
++      return record;
+       }
+ store_free_dns_answer(dnsa);
+ return NULL;
+-- 
+2.30.2
+