On Tuesday 29 January 2008 09:39, Vladimir Dronnikov wrote:
> Attached is the patch against current svn.
> 
> It now sanitizes possible malicious user input.
> And works with Lotus Notes which requires \r\n EOLs.

-                                       if (pipes[i] > STDOUT_FILENO)
+                                       if (pipes[i] > STDERR_FILENO) // let us 
not touch stderr

Why? if pipes[i] == 2 (stderr), then stderr fd was closed
when sendmail was started. Weird, but possible.
And then pipe() used fd 2 for one of pipe ends
(ther is no other way it could end up equal to 2).
Why you don't want to close it?

+       const char *charset = NULL;
+       const char *opt_user = NULL;
+       const char *opt_pass = NULL;

None of these NULLs seem to be needed.

static char *sane(const char *str)

If you are going to modify *str, don't declare it as const.

Applied with modifications. Thanks.
vda
_______________________________________________
busybox mailing list
[email protected]
http://busybox.net/cgi-bin/mailman/listinfo/busybox

Reply via email to