commit 173bd1c8f9cf83ad8c0e61a9e32678e7e371d41d
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Tue Jun 2 14:50:31 2020 +0100

    Taint: fix pam expansion condition.  Bug 2587
    
    (cherry picked from commit f7f933a199be8bb7362c715e0040545b514cddca)

diff --git a/src/src/auths/call_pam.c b/src/src/auths/call_pam.c
index 2959cbbf3..80bb23ec3 100644
--- a/src/src/auths/call_pam.c
+++ b/src/src/auths/call_pam.c
@@ -83,8 +83,7 @@ for (int i = 0; i < num_msg; i++)
     {
     case PAM_PROMPT_ECHO_ON:
     case PAM_PROMPT_ECHO_OFF:
-      arg = string_nextinlist(&pam_args, &sep, big_buffer, big_buffer_size);
-      if (!arg)
+      if (!(arg = string_nextinlist(&pam_args, &sep, NULL, 0)))
 	{
 	arg = US"";
 	pam_arg_ended = TRUE;
@@ -155,7 +154,7 @@ pam_arg_ended = FALSE;
 fail. PAM doesn't support authentication with an empty user (it prompts for it,
 causing a potential mis-interpretation). */
 
-user = string_nextinlist(&pam_args, &sep, big_buffer, big_buffer_size);
+user = string_nextinlist(&pam_args, &sep, NULL, 0);
 if (user == NULL || user[0] == 0) return FAIL;
 
 /* Start off PAM interaction */

commit 63652bbaf66c4bdb388b08fdf3eb8ab1e4d91475
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Tue Jun 2 15:03:36 2020 +0100

    Taint: fix listcount expansion operator.  Bug 2586
    
    (cherry picked from commit 44644c2e404a3ea0191db0b0458e86924fb240bb)

diff --git a/src/src/expand.c b/src/src/expand.c
index 26f7f10ac..6ed22c14d 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -7208,9 +7208,8 @@ while (*s != 0)
         {
 	int cnt = 0;
 	int sep = 0;
-	uschar buffer[256];
 
-	while (string_nextinlist(CUSS &sub, &sep, buffer, sizeof(buffer))) cnt++;
+	while (string_nextinlist(CUSS &sub, &sep, NULL, 0)) cnt++;
 	yield = string_fmt_append(yield, "%d", cnt);
         continue;
         }

commit aabe0ebe82297d7dec3abdfff9c3b1edc34fd8ab
Author: Patrick Boutilier <boutilpj@ednet.ns.ca>
Date:   Tue Jun 2 15:16:10 2020 +0100

    Docs: fix mistaken variable name
    
    (cherry picked from commit eb55cb1d2c5552209e24345e9d21f83ec1eaccf6)

diff --git a/src/README.UPDATING b/src/README.UPDATING
index a0afa8df0..708027f2c 100644
--- a/src/README.UPDATING
+++ b/src/README.UPDATING
@@ -31,9 +31,9 @@ Exim version 4.94
 
 Some Transports now refuse to use tainted data in constructing their delivery
 location; this WILL BREAK configurations which are not updated accordingly.
-In particular: any Transport use of $local_user which has been relying upon
+In particular: any Transport use of $local_part which has been relying upon
 check_local_user far away in the Router to make it safe, should be updated to
-replace $local_user with $local_part_data.
+replace $local_part with $local_part_data.
 
 Attempting to remove, in router or transport, a header name that ends with
 an asterisk (which is a standards-legal name) will now result in all headers

commit 623f07cfdcaca96274ca765d0fcf0761bdf7151b
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Wed Jun 3 11:40:17 2020 +0100

    Taint: fix multiple ACL actions to properly manage tainted argument data
    
    (cherry picked from commit 12b7f811de4a540d0724585aecfa33b5881e2a30)

diff --git a/src/src/acl.c b/src/src/acl.c
index c1d60bbd9..8619cd5ef 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3349,11 +3349,11 @@ for (; cb; cb = cb->next)
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
-      uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
+      uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
       /* Run the dcc backend. */
       rc = dcc_process(&ss);
       /* Modify return code based upon the existence of options. */
-      while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
+      while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
         if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
           rc = FAIL;   /* FAIL so that the message is passed to the next ACL */
       }
@@ -3514,7 +3514,7 @@ for (; cb; cb = cb->next)
       int sep = 0;
       const uschar *s = arg;
       uschar * ss;
-      while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
+      while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
         {
         if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
         else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
@@ -3567,7 +3567,7 @@ for (; cb; cb = cb->next)
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
-      uschar * ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
+      uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
       uschar * opt;
       BOOL defer_ok = FALSE;
       int timeout = 0;
@@ -3672,11 +3672,11 @@ for (; cb; cb = cb->next)
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
-      uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
+      uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
 
       rc = spam(CUSS &ss);
       /* Modify return code based upon the existence of options. */
-      while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
+      while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
         if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
           rc = FAIL;	/* FAIL so that the message is passed to the next ACL */
       }
