Hi all,

I'm afraid I found kinda bug in the code which handles the detection of
"spam-...@domain", to trigger retraining to false positives/negatives.

Remember I had been struggling around this for days? Dspam was never
considering my forwards to spam-cyri...@xxx, just doing nothing, thus
never "learning", thus never finding spam...

I found that, in agent_shared.c :
function : int process_parseto(AGENT_CTX *ATX, const char *buf)
-------------------------
  (...)
  if (!buf)
    return EINVAL;
  h = strstr(buf, "\r\n\r\n");
  if (!h) h = strstr(buf, "\n\n");        [1]
  x = strstr(buf, "<spam-");
 (...)
  if (x > h) x = NULL                  [2]
---------------------------

For this last line [2], I understand that the goal is to ignore any
"spam-" or similar, if it is "after" a double CRLF ("empty line"), which
is probably intended to encode the headers/body boundary.
I am not sure whether this is useful, as this function is called with a
1-line text buffer (fetched line by line in the caller). But that's just
for safety, no big deal.

But, due to line [1] above, if the line does not contain any
double-CRLF, h will be NULL when checking x > h (on line [2]) as this is
not protected. x > NULL will quite often be true, thus x will be reset
to NULL, and we will never conclude a spam-xxx was found.

I changed line [2] to
  if (h &&  x > h) x = NULL;

And that works.

I am not sure in which context this could work before, but I guess this
patch cannot hurt, even if one day, buf contains empty lines.

Hope that helps, it did for me ;-) Tell me if I am wrong on stg...

Regards,
Cyril'

------------------------------------------------------------------------------

_______________________________________________
Dspam-user mailing list
Dspam-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspam-user

Reply via email to