crashes with "IndexError: list index out of range"

[Kai Krakow]

When receiving and parsing a mail which has an unqualified envelope-from, pypolicyd-spf generates the following backtrace:

Aug 20 15:04:27 aaaaa policyd-spf[18616]: Permerror; identity=helo; client-ip=dd.ddd.dd.ddd; helo=aaaa.aa-aaa.aa; envelope-from=aaaaaa; <email address hidden>
Aug 20 15:04:27 aaaaa policyd-spf[18616]: Traceback (most recent call last):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 420, in <module>
Aug 20 15:04:27 aaaaa policyd-spf[18616]: instance_dict, configData)
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 343, in spfcheck
Aug 20 15:04:27 aaaaa policyd-spf[18616]: mfrom_resultpolicy, local = get_resultcodes(configData, 'mfrom')
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 122, in get_resultcodes
Aug 20 15:04:27 aaaaa policyd-spf[18616]: if spf.domainmatch(reject_domain_list, sender_domain[1]):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: IndexError: list index out of range

Addresses and IPs have been obfuscated (a for chars, d for digits). Not sure if this problem can be used for DDOS attacks. Feel free to mark as security vulnerability.

[Scott Kitterman (kitterman)]

What version are you using?

[Kai Krakow (hurikhan77)]

Using 0.7.1... That's the latest stable version in gentoo.

[Hurikhan77+bgo (hurikhan77+bgo)]

When receiving and parsing a mail which has an unqualified envelope-from, pypolicyd-spf generates the following backtrace:

Aug 20 15:04:27 aaaaa policyd-spf[18616]: Permerror; identity=helo; client-ip=dd.ddd.dd.ddd; helo=aaaa.aa-aaa.aa; envelope-from=aaaaaa; <email address hidden>
Aug 20 15:04:27 aaaaa policyd-spf[18616]: Traceback (most recent call last):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 420, in <module>
Aug 20 15:04:27 aaaaa policyd-spf[18616]: instance_dict, configData)
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 343, in spfcheck
Aug 20 15:04:27 aaaaa policyd-spf[18616]: mfrom_resultpolicy, local = get_resultcodes(configData, 'mfrom')
Aug 20 15:04:27 aaaaa policyd-spf[18616]: File "/usr/bin/policyd-spf", line 122, in get_resultcodes
Aug 20 15:04:27 aaaaa policyd-spf[18616]: if spf.domainmatch(reject_domain_list, sender_domain[1]):
Aug 20 15:04:27 aaaaa policyd-spf[18616]: IndexError: list index out of range

Addresses and IPs have been obfuscated (a for chars, d for digits). Not sure if this problem can be used for DDOS attacks. Feel free to mark as security vulnerability.

Reproducible: Always

[Scott Kitterman (kitterman)]

I suspect this is a bug I fixed in 0.7.2. Please see if you can replicate it with either the current release (0.8) or the latest in the 0.7 series (0.7.3).

I'm not at all familiar with how Gentoo packaging works, so I can't advise you on the best way to do that.

[Kai Krakow (hurikhan77)]

I cross-posted it to Gentoo's bugzilla so they can take the steps to stabilize 0.7.3 in the package tree.

[Scott Kitterman (kitterman)]

I see 0.7.3 is at least in Gentoo unstable now, so I'm closing this on this end.

[Pacho-gentoo (pacho-gentoo)]

Please re-test with 0.8.1