4.3T UUCP core dumps on bad control files
David Robinson
david at elroy.jpl.nasa.gov
Tue Sep 4 07:10:38 AEST 1990
Subject: 4.3T UUCP core dumps on bad control files
Index: usr.bin 4.3BSD-tahoe
Description:
If there exists a UUCP control with less than 5 options
uucico will attempt to dereference a NULL pointer through
W_OPTNS (wrkvec[4]). This is caused by an attempt to set the
mailopt and ntfyopt before the array wrkvec is checked for a
valid size.
Repeat-By:
Create a file in the C. uucp subdirectory of the form:
S D.junkBBe42 D.junkSBe42
S D.junkXBe40 X.junkdBe43
Run uucico on a machine that does not allow dereferencing NULL
pointers (aka Sun) and see a SEGV in the call to index().
Fix:
*** cntrl.c-dist Mon Oct 17 08:18:17 1988
--- cntrl.c Wed Aug 22 15:02:34 1990
***************
*** 191,199 ****
logent(rqstr, "REQUEST");
goto sendmsg;
}
- mailopt = index(W_OPTNS, 'm') != NULL;
- ntfyopt = index(W_OPTNS, 'n') != NULL;
-
if (narg < 5 || W_TYPE[1] != '\0') {
char *bnp;
bnp = rindex(Wfile, '/');
--- 191,196 ----
***************
*** 204,209 ****
--- 201,209 ----
Wfile[0] = '\0';
goto top;
}
+ mailopt = index(W_OPTNS, 'm') != NULL;
+ ntfyopt = index(W_OPTNS, 'n') != NULL;
+
sprintf(User, "%.9s", W_USER);
sprintf(rqstr, "(%s %s %s %s)", W_TYPE, W_FILE1,
W_FILE2, W_USER);
--
David Robinson david at elroy.jpl.nasa.gov {decwrl,usc,ames}!elroy!david
Disclaimer: No one listens to me anyway!
"Once a new technology rolls over you, if you're not part of the steamroller,
you're part of the road." - Stewart Brand
More information about the Comp.bugs.4bsd.ucb-fixes
mailing list