commit 2d83468e8de2920cd15b09a044c081feb2bf9bea
from: Martijn van Duren <martijn@openbsd.org>
date: Thu Mar 24 14:16:21 2022 UTC

t tag must be smaller than x tag

commit - a9f7aa12f71d9b3956c76467b51cdec52f2bde73
commit + 2d83468e8de2920cd15b09a044c081feb2bf9bea
blob - c38ca6ba2c1a95a3d5704989d6196790d0203016
blob + b80cf4eb927bb7789db168414f3f9bb9634e945a
--- main.c
+++ main.c
@@ -495,6 +495,10 @@ dkim_signature_parse(struct header *header)
 			return;
 		}
 	}
+	if (sig->t != -1 && sig->x != -1 && sig->t > sig->x) {
+		dkim_signature_state(sig, DKIM_PERMERROR, "t tag after x tag");
+		return;
+	}
 
 	if ((size_t)snprintf(subdomain, sizeof(subdomain), "%s._domainkey.%s",
 	    sig->s, sig->d) >= sizeof(subdomain)) {