[tin 1.7.x] filter.c/nntplib.c fix for broken OVER(view)

Urs Janßen <[email protected]>
Newsgroups gmane.network.tin.devel
Message-ID <[email protected]>
the following patch is against a crash seen on news.mozilla.org
(which is horrible broken (OVER response if different fom XOVER
response and dosen't follow draft-ietf-nntpext-base-27.txt) in
netscape.public.beta.feedback.help (which has a lot of "broken" overview
entries in the OVER case) with a filter entry based on message-id
(and other stuff which isn't relevant in this case)
asthe server responses to LIST EXTENSIONS and claims it knows OVER
tin uses OVER instead of XOVER...

| OVER 294-308
| 224 data follows
| Subject:From:Date:Bytes:Lines
| 294	4282 monografia monografias teses =?ISO-8859-1?Q?disserta=E7=F5es?=  trabalhos escolares 4282	"monografia " <[email protected]>	Wed, 20 Apr 2005 00:11:41-0300 824	14
[...]
| XOVER -
| 224 data follows
| 294	4282 monografia monografias teses =?ISO-8859-1?Q?disserta=E7=F5es?=  trabalhos escolares 4282	"mongrafia  " <[email protected]>	Wed, 20 Apr 2005 00:11:41-0300	<[email protected]>	824	14
[...]

here is what gdb said:
| #0  0x080592f9 in test_regex (string=0x14 <Address 0x14 out of bounds>, regex=Variable "regex" is not available.) at ./filter.c:211
| #1  0x0805c32b in filter_articles (group=0x8141a78) at ./filter.c:1960
| #2  0x0804f55d in index_group (group=0x8141a78) at ./art.c:478 
[...]
| (gdb) frame 1
| #1  0x0805c32b in filter_articles (group=0x8141a78) at ./filter.c:1960
| 1960                                                    x = test_regex(mymsgid, ptr[j].msgid, FALSE, &regex_cache_msgid[j]);
| (gdb) print *group
| $1 = {name = 0x81bbba8 "netscape.public.beta.feedback.help", aliasedto = 0x0, 
|  description = 0x81bd9c8 "?", spooldir = 0x8126000 "", moderated = 121 'y',
|  count = -1, xmax = 308, xmin = 188, type = 1, inrange = 0, 
|  read_during_session = 1, art_was_posted = 0, subscribed = 0, newgroup = 0,
|  bogus = 0, next = -1, newsrc = {present = 1, num_unread = 15, xmax = 308,
|    xmin = 188, xbitlen = 121, xbitmap = 0x81bf288 ""}, attribute = 0x8114040, glob_filter = 0x80fc340}
| (gdb) print *group->glob_filter
| $2 = {max = 36, num = 36, filter = 0x81bdca0}
| (gdb) print *group->glob_filter->filter
| $3 = {comment = 0x0, scope = 0x81bbce8 "*,!akk.*,!tin.*,!local.*,!control*",
|      subj = 0x81bbd98 "(?:^(?:(?:A[Ww]|REPOST|re)\\s?:|[^a-z\\d]+?$|[!?*]|[Rr]e:\\S)|[*$!?]{3,})(?# case sensitive!)",
|      from = 0x81bc2a0 "(?:\\s+[a-z]|(?:(?i)(?:^\\S+\\s*\\S+$|\\s\\s|\\bname\\b|root@|(?:aol|hotmail|bigfoot|yahoo|mailexcite|poboxes)\\.com|@(?:cww|bigfoot|germanynet|cityweb)\\.de|@(?:earthlink|usa)\\.net|^[^(]*(?<=\\.invalid)\\s?)))",
|      msgid = 0x81bbd78 "(?i)<(?:repost|\\S{40,}@)", lines_cmp = 2 '\002', 
|      lines_num = 4, gnksa_cmp = 0 '\0', gnksa_num = 0, score = -31,
|      xref = 0x81bc370 "(([^,]+,){30,}|(^|,)(junk|control)($|,)|(^|,)(alt\\.){6,})",
|      time = 0, next = 0x81bdcd8, inscope = 1, icase = 0, fullref = 6}
| (gdb) print i
| $6 = 0
| (gdb) print *&arts[0]
| $8 = {artnum = 294,  
|   subject = 0x81bed90 "4282 monografia monografias teses dissertações trabalhos escolares 4282", from = 0x81be700 "[email protected]",
|   name = 0x81b5760 "monografia ", gnksa_code = 0, date = 1113966701, 
|   xref = 0x0, msgid = 0x0, refs = 0x0, refptr = 0x0, line_count = -1,
                                         ^^^^^^^^^^^^^
|   archive = 0x0, tagged = 0, thread = -1, prev = -1, score = 0, status = 1,
|   killed = 0, zombie = 0, delete_it = 0, selected = 0, inrange = 0, matched = 0}
| (gdb) print *&arts[0]->refptr->txt
| Cannot access memory at address 0x14

there might be other locations in the code which need similar
protection

--- filter.c	2005-06-28 10:31:21.000000000 +0200
+++ filter.c	2005-07-06 02:56:24.967010142 +0200
@@ -77,8 +74,8 @@
  * Easier access to hashed msgids. Note that in REFS(), y must be free()d
  * msgid is mandatory in an article and cannot be NULL
  */
-#define MSGID(x)			(x->refptr->txt)
-#define REFS(x,y)			((y = get_references(x->refptr->parent)) ? y : "")
+#define MSGID(x)			(x->refptr ? x->refptr->txt : "")
+#define REFS(x,y)			((y = get_references(x->refptr ? x->refptr->parent : NULL)) ? y : "")
 
 /*
  * global filter array
@@ -1936,7 +1933,7 @@
 							break;
 
 						case FILTER_MSGID_LAST:
-							myrefs = (art->refptr->parent) ? art->refptr->parent->txt : "";
+							myrefs = art->refptr ? (art->refptr->parent ? art->refptr->parent->txt : "") : "";
 							mymsgid = MSGID(art);
 							break;
 
--- nntplib.c	2005-06-28 10:31:21.000000000 +0200
+++ nntplib.c	2005-07-06 03:45:14.777744512 +0200
@@ -1104,9 +1104,13 @@
 		buf[0] = '\0';
 		i = new_nntp_command("LIST EXTENSIONS", OK_EXTENSIONS, buf, sizeof(buf));
 		switch (i) {
+			case 215:	/* Netscape-Collabra/3.52 is badly broken; NetWare-News-Server/5.1 */
+				while ((ptr = tin_fgets(FAKE_NNTP_FP, FALSE)) != NULL)
+					;
+				break;
+			
 			case OK_EXTENSIONS:	/* as defined draft-ietf-nntpext-base-24.txt */
 			case 205:	/* M$ Exchange 5.5 */
-			case 215:	/* Netscape-Collabra/3.52 && NetWare-News-Server/5.1 */
 				nntp_caps.type = LIST_EXTENSIONS;
 				while ((ptr = tin_fgets(FAKE_NNTP_FP, FALSE)) != NULL) {
 					if (nntp_caps.type == LIST_EXTENSIONS) {
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.