Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 333629 - mail-filter/pypolicyd-spf-0.7.1 crashes with "IndexError: list index out of range"
Summary: mail-filter/pypolicyd-spf-0.7.1 crashes with "IndexError: list index out of r...
Status: RESOLVED TEST-REQUEST
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Server (show other bugs)
Hardware: All Linux
: High major
Assignee: No maintainer - Look at https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers if you want to take care of it
URL: https://bugs.launchpad.net/pypolicyd-...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-20 14:20 UTC by Kai Krakow
Modified: 2012-02-09 12:27 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kai Krakow 2010-08-20 14:20:58 UTC 
When receiving and parsing a mail which has an unqualified envelope-from, pypolicyd-spf generates the following backtrace:

Aug 20 15:04:27 aaaaa policyd-spf[18616]: Permerror; identity=helo; client-ip=dd.ddd.dd.ddd; helo=aaaa.aa-aaa.aa; envelope-from=aaaaaa; receiver=aaaaaa.aaaaaaa@aaaaaaaa.aa
Aug 20 15:04:27 aaaaa policyd-spf[18616]: Traceback (most recent call last):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 420, in <module>
Aug 20 15:04:27 aaaaa policyd-spf[18616]: instance_dict, configData)
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 343, in spfcheck
Aug 20 15:04:27 aaaaa policyd-spf[18616]: mfrom_resultpolicy, local = get_resultcodes(configData, 'mfrom')
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 122, in get_resultcodes
Aug 20 15:04:27 aaaaa policyd-spf[18616]: if spf.domainmatch(reject_domain_list, sender_domain[1]):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: IndexError: list index out of range

Addresses and IPs have been obfuscated (a for chars, d for digits). Not sure if this problem can be used for DDOS attacks. Feel free to mark as security vulnerability.

Reproducible: Always
Comment 1 Pacho Ramos gentoo-dev 2012-02-09 12:27:54 UTC 
Please re-test with 0.8.1