Prereq: "3.3.16" diff -ur --new-file /var/tmp/postfix-3.3.16/src/global/mail_version.h ./src/global/mail_version.h --- /var/tmp/postfix-3.3.16/src/global/mail_version.h 2021-01-17 10:21:54.000000000 -0500 +++ ./src/global/mail_version.h 2021-04-11 10:51:11.000000000 -0400 @@ -20,8 +20,8 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20210117" -#define MAIL_VERSION_NUMBER "3.3.16" +#define MAIL_RELEASE_DATE "20210411" +#define MAIL_VERSION_NUMBER "3.3.17" #ifdef SNAPSHOT #define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE diff -ur --new-file /var/tmp/postfix-3.3.16/HISTORY ./HISTORY --- /var/tmp/postfix-3.3.16/HISTORY 2021-01-17 09:55:25.000000000 -0500 +++ ./HISTORY 2021-04-11 10:48:36.000000000 -0400 @@ -23719,3 +23719,18 @@ causing unnecessary dnssec_probe activity. The default is now "dane" when smtp_tls_security_level is "dane", otherwise it is "may". File: global/mail_params.h. + +20210411 + + Null pointer bug (introduced: Postfix 3.0) after an inline: + table syntax error in main.cf or master.cf. Found by Coverity, + reported by Jaroslav Skarvada. Based on fix by Viktor + Dukhovni. File: util/dict_inline.c. + + Incomplete null pointer check (introduced: Postfix 2.10) + after truncated HaProxy version 1 handshake message. Found + by Coverity, reported by Jaroslav Skarvada. Fix by Viktor + Dukhovni. File: global/haproxy_srvr.c. + + Missing null pointer check (introduced: Postfix alpha) after + null argv[0] value. File: global/mail_task.c. diff -ur --new-file /var/tmp/postfix-3.3.16/src/global/haproxy_srvr.c ./src/global/haproxy_srvr.c --- /var/tmp/postfix-3.3.16/src/global/haproxy_srvr.c 2012-06-17 13:47:09.000000000 -0400 +++ ./src/global/haproxy_srvr.c 2021-04-04 14:56:19.000000000 -0400 @@ -59,6 +59,8 @@ static INET_PROTO_INFO *proto_info; +#define STR_OR_NULL(str) ((str) ? (str) : "(null)") + /* haproxy_srvr_parse_lit - extract and validate string literal */ static int haproxy_srvr_parse_lit(const char *str,...) @@ -68,7 +70,7 @@ int result = -1; if (msg_verbose) - msg_info("haproxy_srvr_parse: %s", str); + msg_info("haproxy_srvr_parse: %s", STR_OR_NULL(str)); if (str != 0) { va_start(ap, str); @@ -85,8 +87,10 @@ static int haproxy_srvr_parse_proto(const char *str, int *addr_family) { if (msg_verbose) - msg_info("haproxy_srvr_parse: proto=%s", str); + msg_info("haproxy_srvr_parse: proto=%s", STR_OR_NULL(str)); + if (str == 0) + return (-1); #ifdef AF_INET6 if (strcasecmp(str, "TCP6") == 0) { if (strchr((char *) proto_info->sa_family_list, AF_INET6) != 0) { @@ -110,7 +114,8 @@ int addr_family) { if (msg_verbose) - msg_info("haproxy_srvr_parse: addr=%s proto=%d", str, addr_family); + msg_info("haproxy_srvr_parse: addr=%s proto=%d", + STR_OR_NULL(str), addr_family); if (str == 0 || strlen(str) >= sizeof(MAI_HOSTADDR_STR)) return (-1); @@ -145,7 +150,7 @@ static int haproxy_srvr_parse_port(const char *str, MAI_SERVPORT_STR *port) { if (msg_verbose) - msg_info("haproxy_srvr_parse: port=%s", str); + msg_info("haproxy_srvr_parse: port=%s", STR_OR_NULL(str)); if (str == 0 || strlen(str) >= sizeof(MAI_SERVPORT_STR) || !valid_hostport(str, DONT_GRIPE)) { return (-1); diff -ur --new-file /var/tmp/postfix-3.3.16/src/global/mail_task.c ./src/global/mail_task.c --- /var/tmp/postfix-3.3.16/src/global/mail_task.c 2009-07-12 15:19:43.000000000 -0400 +++ ./src/global/mail_task.c 2021-04-04 15:16:09.000000000 -0400 @@ -52,6 +52,8 @@ const char *slash; const char *tag; + if (argv0 == 0) + argv0 = "unknown"; if (canon_name == 0) canon_name = vstring_alloc(10); if ((slash = strrchr(argv0, '/')) != 0 && slash[1]) diff -ur --new-file /var/tmp/postfix-3.3.16/src/util/dict_inline.c ./src/util/dict_inline.c --- /var/tmp/postfix-3.3.16/src/util/dict_inline.c 2017-12-27 17:29:45.000000000 -0500 +++ ./src/util/dict_inline.c 2021-04-04 15:06:35.000000000 -0400 @@ -113,9 +113,9 @@ dict = dict_open3(DICT_TYPE_HT, name, open_flags, dict_flags); dict_type_override(dict, DICT_TYPE_INLINE); while ((nameval = mystrtokq(&cp, CHARS_COMMA_SP, CHARS_BRACE)) != 0) { - if ((nameval[0] != CHARS_BRACE[0] - || (err = xperr = extpar(&nameval, CHARS_BRACE, EXTPAR_FLAG_STRIP)) == 0) - && (err = split_qnameval(nameval, &vname, &value)) != 0) + if (nameval[0] == CHARS_BRACE[0]) + err = xperr = extpar(&nameval, CHARS_BRACE, EXTPAR_FLAG_STRIP); + if (err != 0 || (err = split_qnameval(nameval, &vname, &value)) != 0) break; /* No duplicate checks. See comments in dict_thash.c. */