Re: Problem with long subject lines

On Wed, 18 Aug 1999, Erik Corry wrote:

> I see Paul fixed the problem of long subject lines causing hypermail
> to crash

Didn't I do that fix? ;-)

> but I am concerned about how many buffer overflow problems remain in
> hypermail.

So are the rest of us. I could even go as far to say that I am concerned about every remaining bug in hypermail.

> Most of these bugs can be abused to crack into a system

Well, we all know what buffer overflows can do and can't. You could start with not running hypermail as root or any other user that has any wide system rights. It'll save you from the worst kinds of possible attacks.

> I wonder whether anyone has read through the source looking for problems

I have read the source a few times by now, but I have not specificly search for remaining buffer overflows, no.

If buffer overflows is a concern, I strongly urge you to use the 2a24 version and no other since this should be the version with the least amount of overflows left. I am of course interested in all reports on buffer problems, in the source or with an input that causes it.

> since January when Daniel said "Hypermail is filled with buffer
> overflows."

I described the situation we had then. I was very frustrated at how the project (didn't) develop, but that has improved since. Hypermail was getting through a pretty major rewrite when I started the alpha-series since I did a major job of removing the use of static sized buffers all over and introduced dynamic buffering to a very large extent. That work is likely to still have bugs left and a few old-style buffer overflow-risks. Like that long-subject lines crash the other week.

Anyone willing to help out with this is very welcome.

-- 
             Daniel Stenberg - http://www.fts.frontec.se/~dast
   ech`echo xiun|tr nu oc|sed 'sx\([sx]\)\([xoi]\)xo un\2\1 is xg'`ol