blob: 5d616458bc44981cd759cfcbc40938807b37ed06 [file] [log] [blame]
Patrick Williamsc124f4f2015-09-15 14:41:29 -05001From 9984ae5cb0ea0d61df1612b06952a61323c083d9 Mon Sep 17 00:00:00 2001
2From: Florian Weimer <fweimer@redhat.com>
3Date: Mon, 17 Nov 2014 11:13:38 +0100
4Subject: [PATCH 1/4] outof: Introduce expandaddr flag
5
6Document that address expansion is disabled unless the expandaddr
7binary option is set.
8
9This has been assigned CVE-2014-7844 for BSD mailx, but it is not
10a vulnerability in Heirloom mailx because this feature was documented.
11
12This patch is taken from
13ftp://ftp.debian.org/debian/pool/main/h/heirloom-mailx/heirloom-mailx_12.5-5.debian.tar.xz
14
15Upstream-Status: Inappropriate [upstream is dead]
16---
17 mailx.1 | 14 ++++++++++++++
18 names.c | 3 +++
19 2 files changed, 17 insertions(+)
20
21diff --git a/mailx.1 b/mailx.1
22index 70a7859..22a171b 100644
23--- a/mailx.1
24+++ b/mailx.1
25@@ -656,6 +656,14 @@ but any reply returned to the machine
26 will have the system wide alias expanded
27 as all mail goes through sendmail.
28 .SS "Recipient address specifications"
29+If the
30+.I expandaddr
31+option is not set (the default), recipient addresses must be names of
32+local mailboxes or Internet mail addresses.
33+.PP
34+If the
35+.I expandaddr
36+option is set, the following rules apply:
37 When an address is used to name a recipient
38 (in any of To, Cc, or Bcc),
39 names of local mail folders
40@@ -2391,6 +2399,12 @@ and exits immediately.
41 If this option is set,
42 \fImailx\fR starts even with an empty mailbox.
43 .TP
44+.B expandaddr
45+Causes
46+.I mailx
47+to expand message recipient addresses, as explained in the section,
48+Recipient address specifications.
49+.TP
50 .B flipr
51 Exchanges the
52 .I Respond
53diff --git a/names.c b/names.c
54index 66e976b..c69560f 100644
55--- a/names.c
56+++ b/names.c
57@@ -268,6 +268,9 @@ outof(struct name *names, FILE *fo, struct header *hp)
58 FILE *fout, *fin;
59 int ispipe;
60
61+ if (value("expandaddr") == NULL)
62+ return names;
63+
64 top = names;
65 np = names;
66 time(&now);
67--
681.9.3
69
70