Path: utzoo!mnetor!uunet!husc6!cmcl2!brl-adm!umd5!ames!sdcsvax!ucsdhub!hp-sdd!ncr-sd!crash!bblue
From: bblue@crash.cts.com (Bill Blue)
Newsgroups: news.software.b
Subject: Re: Strange Core Dumps
Message-ID: <2152@crash.cts.com>
Date: 16 Dec 87 21:00:04 GMT
References: <2122@crash.cts.com> <2479@fluke.COM>
Reply-To: bblue@crash.CTS.COM (Bill Blue)
Organization: Crash TS, El Cajon, CA
Lines: 43

In article <2479@fluke.COM> battan@tc.fluke.COM (Jim Battan) writes:
>In article <2122@crash.cts.com>, bblue@crash.cts.com (Bill Blue) writes
>about how rnews is leaving around articles and core dumps when processing
>certain articles having Message-ID's of the form:
>> >Message-ID: 
>
>John Gilmore has the right idea.  This is a problem with an sprintf
>overflowing due to not having enough memory and/or arguments.  The
>% in the Message-ID is sent through sprintf when the article's
>forwarding to other sites gets recorded in the log file.  Specifically,
>in broadcast() (ifuncs.c), "sentbuf" gets the Message-ID and a list
>of sites the article is sent to.  This is then sprintf-ed through
>in log(), where it bombs.  How articles then get sent to the other sites
>is mysterious, but I don't understand enough about the flow of the
>articles to be sure.  Below, please find a suitable context diff that
>can be sent thru patch(1L).  I've mailed the diff to Rick Adams for
>inclusion in patch n.  Since the articles get posted correctly even
>with this bug, you could wait for the official patch if you're the
>cautious type.  Another possible fix could have been to the call to
>log() in broadcast(), ala'
>	log("%s", sentbuf);
>but my fix will (hopefully) have the same effect.  Note that I haven't
>yet found an incoming article to really test this on.  And a general
>disclaimer:  This works for me; your mileage may vary.
[patch code deleted]

What I don't understand, Jim, is why you'd go to all the bother adding
that code segment to double %'s, when the above example would accomplish
the same thing?

Anyway, I made the syntax change in broadcast() (in ifuncs.c) of the
log() call as shown above, and it seems to be happy!  I had saved a
couple of the problematic articles, and piped one through my original
inews, and then again through the one with the above fix.  As expected,
the former core dumped (and then some), while the latter worked just
fine.

I encourage everyone to install this fix, and for it to be included
in the next patch.

Thanks to Jim and others who responded to this problem.

--Bill