Fix SPA authenticator, checking client-supplied data before using it. Bug 2571

[user/henk/code/exim.git] / src / src / smtp_out.c

diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index 96ee152826ef504cbbf529cd35b3ae45afe1f388..6f7fb85c11a28da11d59de583d0b0ea1b546a43c 100644 (file)
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -3,6 +3,7 @@
 *************************************************/
 
 /* Copyright (c) University of Cambridge 1995 - 2018 */
+/* Copyright (c) The Exim Maintainers 2020 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* A number of functions for driving outgoing SMTP calls. */
@@ -63,8 +64,8 @@ if (is_tainted(expint))
   return FALSE;
   }
 
-while (isspace(*expint)) expint++;
-if (*expint == 0) return TRUE;
+Uskip_whitespace(&expint);
+if (!*expint) return TRUE;
 
 while ((iface = string_nextinlist(&expint, &sep, big_buffer,
           big_buffer_size)))
@@ -500,7 +501,7 @@ else
     rc = n;
     }
   else
-
+    {
     rc = send(outblock->cctx->sock, outblock->buffer, n,
 #ifdef MSG_MORE
              more ? MSG_MORE : 0
@@ -508,6 +509,7 @@ else
              0
 #endif
             );
+    }
   }
 
 if (rc <= 0)