bugThe nmh Mail Handling System - Bugs: bug #23167, ruserpass.c: segfaults if netrc...

 
 

bug #23167: ruserpass.c: segfaults if netrc world readable

Submitted by:  Peter Maydell <pm215>
Submitted on:  Sun 04 May 2008 04:40:44 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 04 May 2008 10:03:17 PM UTC, comment #1:

I've fixed this in CVS (by making ruserpass call adios, as I suggested).

Peter Maydell <pm215>
Project Administrator
Sun 04 May 2008 04:40:44 PM UTC, original submission:

golanth$ ls -l ~/.netrc
-rw-rw-r-- 1 pm215 pm215 64 2008-05-04 17:23 /home/pm215/.netrc
golanth$ uip/post ~/draft -watch -sasl
Error - .netrc file not correct mode.
Remove password or correct mode.
Segmentation fault (core dumped)

This is happening because ruserpass() detects the bad permissions (and prints the error). However it then returns -1 and does not set aname or apass. Unfortunately all its callers seem to assume it will never fail. In this case code in mts/smtp/smtp.c is doing a strlen() on the password pointer which is still NULL.

It might be simplest just to have ruserpass() call adios() in this case rather than have all the callers have to cope with this.

Also I suspect the function is not correctly closing the netrc file in all code paths.

Peter Maydell <pm215>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by pm215 (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 04 May 2008 10:03:17 PM UTCpm215StatusNone=>Fixed
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1