bugThe nmh Mail Handling System - Bugs: bug #11142, POP3 inc chokes on very long lines

 
 

bug #11142: POP3 inc chokes on very long lines

Submitter:  Nick Barnes <nickbarnes>
Submitted:  Fri 26 Nov 2004 03:04:13 PM UTC
   
 
Category:  Bug Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Wont Fix
Assigned to:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 19 Dec 2012 12:22:12 AM UTC, comment #4: 

I'm closing this, primarily based on the comment that it couldn't be replicated with 1.1rc3.  Also, the code has changed so much in the last 8 years that the patch would no longer apply.

Also, I question whether it's necessary to support lines >1K.

David Levine <levine>
Group administrator
Thu 17 Feb 2011 01:18:36 PM UTC, comment #3: 

Migrating my mail home to a newer FreeBSD, I am offered nmh 1.2 by the ports collection.  Is this bug fixed on nmh 1.2, or do I have to figure out how to port my patch across?
(nmh 1.2 seems to have been released about 4 years after I first reported this bug and provided a patch).

Nick Barnes <nickbarnes>
Sat 19 Nov 2005 04:55:35 PM UTC, comment #2: 

Looking at the source, I don't think this bug has been fixed.

Peter Maydell <pm215>
Group administrator
Fri 26 Nov 2004 03:11:58 PM UTC, comment #1: 

Can't get a test message to fail with 1.1rc3, so maybe this is fixed already.  Does anyone know?

Nick Barnes <nickbarnes>
Fri 26 Nov 2004 03:04:13 PM UTC, original submission:  

inc from NMH 1.0.4_1 on FreeBSD chokes on very long lines (> 1K).  Attached here is a patch which I developed which fixes this bug.  I reported this to the nmh-bugs mailing list back in January 2002, and didn't really get any response.  I've been maintaining it locally since then.

I don't know whether the bug is still present in 1.1rc3.

What's happening is that (when you have a line longer than 1K in the body of a message) the buffer filled from the POP3 connection is too large to be copied into another fixed-size
buffer along with a terminating \0.  The problem is that the resulting buffer doesn't get a terminating \0, so if it is
sent to stdout or to a file with [f]printf("%s"), you get a read overflow and some amount of garbage output (and/or a crash if the buffer is just before an unmapped page in memory).

Nick Barnes <nickbarnes>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #2107:  nb-patch added by nickbarnes (15KiB - application/octet-stream - patch for NMH 1.0.4)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by levine (Posted a comment)
  • -email is unavailable- added by nickbarnes (Posted a comment)
  • -email is unavailable- added by pm215 (Updated the item)
  •  

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-12-19 levine StatusNone Wont Fix
        Open/ClosedOpen Closed
    2008-12-29 pm215 CategoryNone Bug
    2004-11-26 nickbarnes Attached File- Added nb-patch, #1918

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code