(fwd) Re: Segfault when reading group

----- [ Non-member submission from [Matus UHLAR - fantomas <[email protected]>] -----

Hello,

> On Thu, Feb 17, 2005 at 10:39:08PM +0100, Philip Paeps wrote:
>> Recently, while trying to load comp.unix.bsd.freebsd.misc, Tin segfaults
>> around 98%.  I'm seeing this with the last couple of snaps (can't remember
>> exactly when it started, but I can try to narrow it down) on FreeBSD-current
>> running on x86.
>> 
>> Running Tin in a debugger, gives me this stack trace:
>> 
>> Group comp.unix.bsd.freebsd.misc ('q' to quit)...  98% (0:00 remaining)
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x0809716d in rfc1522_do_encode (what=0x9668a20 '.' <repeats 200 times>..., where=0x3d45323d, 
>>     charset=0x323d4532 <Error reading address 0x323d4532: Bad address>, break_long_line=1160920389) at ././rfc2047.c:620
>> 620                                             if (ewsize >= 70 - strlen(charset) && (contains_nonprintables(what, isstruct_head) || isbroken_within)) {

[deleted]

>> (gdb) l rfc2047.c:620
>> 615     /*
>> 616      * if a word with 8bit chars is broken in the middle, whatever follows
>> 617      * after the point where it's split should be encoded (i.e. even if
>> 618      * they are made of only 7bit chars)
>> 619      */
>> 620                                             if (ewsize >= 70 - strlen(charset) && (contains_nonprintables(what, isstruct_head) || isbroken_within)) {
>> 621                                                     *t++ = ' ';
>> 622                                                     ewsize++;
>> 623                                             }
>> 624                                             quoting = FALSE;

Seems I encountered the same bug today.

> manually obtain a copy of the overview data from the group and
> examine all the From and Subject fields which are RFC2047 encoded,
> and see if something looks strange, then feed the crashing function
> with that strange data only  and see if it causes the crash.
> 
> e.g.:
> ~ > script cubfm.log
> Script started, file is cubfm.log
> ~ > telnet news nntp
>> trying 127.0.0.1
>> Connected to news.
> < 200 posting ok
>> GROUP comp.unix.bsd.freebsd.misc
> < 211 1 1 2 comp.unix.bsd.freebsd.misc
>> XOVER -
> < 224 data follows
> [...]
> < .
>> QUIT
> < 205 .
> < Connection closed by foreign host.
> ~ > exit
> Script done, file is cubfm.log
> ~ > awk -F'     ' '/=\?/{print "N:#"$1"# S:#"$2"# F:#"$3"#"}' < cubfm.log
> [fieldseperator is tab]
> 
> urs

I've found two lines containing such characters. Two of them contained Esc
char, thirs containted ^R and ^T chars. I can attach them, insert them
here or put them on the web... which one do you prefer?

----- End forwarded message -----