Hi David, on Fri, Nov 04, 2005 at 19:22:38 -0500, you wrote:
> The attached patch fixes both problems. But unfortunately introduces new ones: > static char *get_string(const char *name, const char *arg) > { > char *s = xstrdup(arg); > + > + /* scan option to delete comment (after '#') and preceding > whitespace */ > + char *t = s; t initially points to s, a copy of arg... > + bool quote = false; > + for (t = s; *t != '\0' ; t += 1) > + { > + char c = *t; > + if (c == '"') > + quote ^= true; > + if (!quote && c == '#') { > + *t-- = '\0'; ...if arg starts with a '#' (ie. something like "option=# foo" in the config), t will now point one byte before the beginning of s... > + while (isspace(*t)) ...and thus a faulty memory access will happen here. > + *t-- = '\0'; > + break; > + } > + } The attached fixed version of the patch avoids this (and further code duplication) by using the existing remove_comment() function, which already is used by other get_*() functions. The other problem is that init_charset_table_iconv() is not the only place bf_iconv_open() is used without checking for a result of -1. text_decode() in lexer.c contains the lines cd = bf_iconv_open( charset_unicode, charset ); iconvert_cd(cd, &src, buf); and iconvert_cd() checks for cd == NULL only. Thus I think it makes more sense to fix bf_iconv_open() itself to always return NULL on failure, like in the attached patch. elmar -- .'"`. /"\ | :' : Elmar Hoffmann <[EMAIL PROTECTED]> ASCII Ribbon Campaign \ / `. `' GPG key available via pgp.net against HTML email X `- & vCards / \
diff -ru bogofilter-0.96.4.orig/src/bogoconfig.c bogofilter-0.96.4/src/bogoconfig.c --- bogofilter-0.96.4.orig/src/bogoconfig.c 2005-10-31 13:07:12.000000000 +0100 +++ bogofilter-0.96.4/src/bogoconfig.c 2005-11-05 02:14:59.396592326 +0100 @@ -169,6 +169,7 @@ static char *get_string(const char *name, const char *arg) { char *s = xstrdup(arg); + remove_comment(s); if (DEBUG_CONFIG(2)) fprintf(dbgout, "%s -> '%s'\n", name, s); return s; diff -ru bogofilter-0.96.4.orig/src/bogolexer.c bogofilter-0.96.4/src/bogolexer.c --- bogofilter-0.96.4.orig/src/bogolexer.c 2005-10-31 13:07:12.000000000 +0100 +++ bogofilter-0.96.4/src/bogolexer.c 2005-11-05 02:15:46.826805751 +0100 @@ -92,6 +92,7 @@ static char *get_string(const char *name, const char *arg) { char *s = xstrdup(arg); + remove_comment(s); if (DEBUG_CONFIG(2)) fprintf(dbgout, "%s -> '%s'\n", name, s); return s; diff -ru bogofilter-0.96.4.orig/src/convert_unicode.c bogofilter-0.96.4/src/convert_unicode.c --- bogofilter-0.96.4.orig/src/convert_unicode.c 2005-07-27 00:11:20.000000000 +0200 +++ bogofilter-0.96.4/src/convert_unicode.c 2005-11-05 02:56:14.253757661 +0100 @@ -33,7 +33,7 @@ #define SP ' ' #include <iconv.h> -iconv_t cd; +iconv_t cd = NULL; static void map_nonascii_characters(void) { @@ -115,7 +115,10 @@ from_charset, to_charset ); /* error - map default charset to unicode */ xd = iconv_open( charset_unicode, charset_default ); - } + if (xd == (iconv_t)(-1)) + xd = NULL; + } else + xd = NULL; } return xd;
signature.asc
Description: Digital signature