Hi David,

on Fri, Nov 04, 2005 at 19:22:38 -0500, you wrote:

> The attached patch fixes both problems.

But unfortunately introduces new ones:

>  static char *get_string(const char *name, const char *arg)
>  {
>      char *s = xstrdup(arg);
> +
> +    /* scan option to delete comment (after '#') and preceding
> whitespace */
> +    char *t = s;

t initially points to s, a copy of arg...

> +    bool quote = false;
> +    for (t = s; *t != '\0' ; t += 1)
> +    {
> +       char c = *t;
> +       if (c == '"')
> +           quote ^= true;
> +       if (!quote && c == '#') {
> +           *t-- = '\0';

...if arg starts with a '#' (ie. something like "option=# foo" in the
config), t will now point one byte before the beginning of s...

> +           while (isspace(*t))

...and thus a faulty memory access will happen here.

> +               *t-- = '\0';
> +           break;
> +       }
> +    }

The attached fixed version of the patch avoids this (and further code
duplication) by using the existing remove_comment() function, which
already is used by other get_*() functions.

The other problem is that init_charset_table_iconv() is not the only
place bf_iconv_open() is used without checking for a result of -1.
text_decode() in lexer.c contains the lines
            cd = bf_iconv_open( charset_unicode, charset );
            iconvert_cd(cd, &src, buf);
and iconvert_cd() checks for cd == NULL only.

Thus I think it makes more sense to fix bf_iconv_open() itself to
always return NULL on failure, like in the attached patch.

elmar

-- 

 .'"`.                                                            /"\
| :' :   Elmar Hoffmann <[EMAIL PROTECTED]>    ASCII Ribbon Campaign  \ /
`. `'    GPG key available via pgp.net        against HTML email   X
  `-                                                    & vCards  / \
diff -ru bogofilter-0.96.4.orig/src/bogoconfig.c 
bogofilter-0.96.4/src/bogoconfig.c
--- bogofilter-0.96.4.orig/src/bogoconfig.c     2005-10-31 13:07:12.000000000 
+0100
+++ bogofilter-0.96.4/src/bogoconfig.c  2005-11-05 02:14:59.396592326 +0100
@@ -169,6 +169,7 @@
 static char *get_string(const char *name, const char *arg)
 {
     char *s = xstrdup(arg);
+    remove_comment(s);
     if (DEBUG_CONFIG(2))
        fprintf(dbgout, "%s -> '%s'\n", name, s);
     return s;
diff -ru bogofilter-0.96.4.orig/src/bogolexer.c 
bogofilter-0.96.4/src/bogolexer.c
--- bogofilter-0.96.4.orig/src/bogolexer.c      2005-10-31 13:07:12.000000000 
+0100
+++ bogofilter-0.96.4/src/bogolexer.c   2005-11-05 02:15:46.826805751 +0100
@@ -92,6 +92,7 @@
 static char *get_string(const char *name, const char *arg)
 {
     char *s = xstrdup(arg);
+    remove_comment(s);
     if (DEBUG_CONFIG(2))
        fprintf(dbgout, "%s -> '%s'\n", name, s);
     return s;
diff -ru bogofilter-0.96.4.orig/src/convert_unicode.c 
bogofilter-0.96.4/src/convert_unicode.c
--- bogofilter-0.96.4.orig/src/convert_unicode.c        2005-07-27 
00:11:20.000000000 +0200
+++ bogofilter-0.96.4/src/convert_unicode.c     2005-11-05 02:56:14.253757661 
+0100
@@ -33,7 +33,7 @@
 #define        SP      ' '
 
 #include <iconv.h>
-iconv_t cd;
+iconv_t cd = NULL;
 
 static void map_nonascii_characters(void)
 {
@@ -115,7 +115,10 @@
                        from_charset, to_charset );
            /* error - map default charset to unicode */
            xd = iconv_open( charset_unicode, charset_default );
-       }
+           if (xd == (iconv_t)(-1))
+               xd = NULL;
+       } else
+           xd = NULL;
     }
 
     return xd;

Attachment: signature.asc
Description: Digital signature

Reply via email to