Send inn-committers mailing list submissions to
        inn-committers@lists.isc.org

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.isc.org/mailman/listinfo/inn-committers
or, via email, send a message with subject or body 'help' to
        inn-committers-requ...@lists.isc.org

You can reach the person managing the list at
        inn-committers-ow...@lists.isc.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of inn-committers digest..."


Today's Topics:

   1. INN commit: trunk (CONTRIBUTORS storage/timecaf/caf.c)
      (INN Commit)
   2. INN commit: branches/2.5 (CONTRIBUTORS storage/timecaf/caf.c)
      (INN Commit)
   3. INN commit: trunk (doc/pod/news.pod
      innfeed/imap_connection.c) (INN Commit)
   4. INN commit: branches/2.5 (doc/pod/news.pod
      innfeed/imap_connection.c) (INN Commit)
   5. INN commit: trunk (lib/clientactive.c nnrpd/misc.c
      nnrpd/perl.c) (INN Commit)
   6. INN commit: branches/2.5 (lib/clientactive.c nnrpd/misc.c
      nnrpd/perl.c) (INN Commit)


----------------------------------------------------------------------

Message: 1
Date: Tue, 25 Jun 2013 10:13:31 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: trunk (CONTRIBUTORS storage/timecaf/caf.c)
Message-ID: <20130625171331.df97967...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:13:31
  Author: iulius
Revision: 9492

fix segfault during dereferencing

Remove a useless unlink().

Thanks to David Binderman for having reported the issue.

Modified:
  trunk/CONTRIBUTORS
  trunk/storage/timecaf/caf.c

-----------------------+
 CONTRIBUTORS          |    2 +-
 storage/timecaf/caf.c |   21 +++++++++++----------
 2 files changed, 12 insertions(+), 11 deletions(-)

Modified: CONTRIBUTORS
===================================================================
--- CONTRIBUTORS        2013-06-24 18:36:24 UTC (rev 9491)
+++ CONTRIBUTORS        2013-06-25 17:13:31 UTC (rev 9492)
@@ -275,4 +275,4 @@
 Lars Magne Ingebrigtsen, Sam Varshavchik, Matthew Vernon, Ian Jackson,
 Edmund H. Ramm, Raphael Barrois, Bo Lindbergh, Matthias Meyser,
 Dennis Preiser, Paolo Amoroso, Dennis Davis, River Tarnell, Jochen Schmitt,
-Tim Fardell, Remco Rijnders
+Tim Fardell, Remco Rijnders, David Binderman

Modified: storage/timecaf/caf.c
===================================================================
--- storage/timecaf/caf.c       2013-06-24 18:36:24 UTC (rev 9491)
+++ storage/timecaf/caf.c       2013-06-25 17:13:31 UTC (rev 9492)
@@ -1559,15 +1559,14 @@
            ** this next fseeko might actually fail, because we have buffered
            ** stuff that might fail on write.
            */
-           if (fseeko(infile, sizeof(CAFHEADER) + head.FreeZoneTabSize,
-                      SEEK_SET) < 0) {
-               perror(path);
-               free(tocarray);
-               free(newpath);
-               fclose(infile);
-               unlink(newpath);
-               return -1;
-           }
+            if (fseeko(infile, sizeof(CAFHEADER) + head.FreeZoneTabSize,
+                       SEEK_SET) < 0) {
+                perror(path);
+                free(tocarray);
+                free(newpath);
+                fclose(infile);
+                return -1;
+            }
            if (fwrite(tocarray, sizeof(CAFTOCENT), head.High - newlow + 1, 
infile) < head.High - newlow + 1
                || fflush(infile) < 0) {
                CAFError(CAF_ERR_IO);
@@ -1682,7 +1681,9 @@
 
     /* initialize blocksize, zeroes buffer. */
     blocksize = newhead.BlockSize;
-    if (blocksize == 0) blocksize=CAF_DEFAULT_BLOCKSIZE;
+    if (blocksize == 0) {
+        blocksize=CAF_DEFAULT_BLOCKSIZE;
+    }
 
     zerobuff = xcalloc(blocksize, 1);
 



------------------------------

Message: 2
Date: Tue, 25 Jun 2013 10:14:34 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: branches/2.5 (CONTRIBUTORS storage/timecaf/caf.c)
Message-ID: <20130625171435.02d2a67...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:14:34
  Author: iulius
Revision: 9493

fix segfault during dereferencing

Remove a useless unlink().

Thanks to David Binderman for having reported the issue.

Modified:
  branches/2.5/CONTRIBUTORS
  branches/2.5/storage/timecaf/caf.c

-----------------------+
 CONTRIBUTORS          |    2 +-
 storage/timecaf/caf.c |   21 +++++++++++----------
 2 files changed, 12 insertions(+), 11 deletions(-)

Modified: CONTRIBUTORS
===================================================================
--- CONTRIBUTORS        2013-06-25 17:13:31 UTC (rev 9492)
+++ CONTRIBUTORS        2013-06-25 17:14:34 UTC (rev 9493)
@@ -275,4 +275,4 @@
 Lars Magne Ingebrigtsen, Sam Varshavchik, Matthew Vernon, Ian Jackson,
 Edmund H. Ramm, Raphael Barrois, Bo Lindbergh, Matthias Meyser,
 Dennis Preiser, Paolo Amoroso, Dennis Davis, River Tarnell, Jochen Schmitt,
-Tim Fardell, Remco Rijnders
+Tim Fardell, Remco Rijnders, David Binderman

Modified: storage/timecaf/caf.c
===================================================================
--- storage/timecaf/caf.c       2013-06-25 17:13:31 UTC (rev 9492)
+++ storage/timecaf/caf.c       2013-06-25 17:14:34 UTC (rev 9493)
@@ -1559,15 +1559,14 @@
            ** this next fseeko might actually fail, because we have buffered
            ** stuff that might fail on write.
            */
-           if (fseeko(infile, sizeof(CAFHEADER) + head.FreeZoneTabSize,
-                      SEEK_SET) < 0) {
-               perror(path);
-               free(tocarray);
-               free(newpath);
-               fclose(infile);
-               unlink(newpath);
-               return -1;
-           }
+            if (fseeko(infile, sizeof(CAFHEADER) + head.FreeZoneTabSize,
+                       SEEK_SET) < 0) {
+                perror(path);
+                free(tocarray);
+                free(newpath);
+                fclose(infile);
+                return -1;
+            }
            if (fwrite(tocarray, sizeof(CAFTOCENT), head.High - newlow + 1, 
infile) < head.High - newlow + 1
                || fflush(infile) < 0) {
                CAFError(CAF_ERR_IO);
@@ -1682,7 +1681,9 @@
 
     /* initialize blocksize, zeroes buffer. */
     blocksize = newhead.BlockSize;
-    if (blocksize == 0) blocksize=CAF_DEFAULT_BLOCKSIZE;
+    if (blocksize == 0) {
+        blocksize=CAF_DEFAULT_BLOCKSIZE;
+    }
 
     zerobuff = xcalloc(blocksize, 1);
 



------------------------------

Message: 3
Date: Tue, 25 Jun 2013 10:27:13 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: trunk (doc/pod/news.pod
        innfeed/imap_connection.c)
Message-ID: <20130625172713.8739167...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:27:13
  Author: iulius
Revision: 9494

imapfeed:  fix buffer overflow

Fixed a buffer overflow when using imapfeed with more than a million
commands during the same IMAP session.

Thanks to David Binderman for having reported the issue.

Modified:
  trunk/doc/pod/news.pod
  trunk/innfeed/imap_connection.c

---------------------------+
 doc/pod/news.pod          |    8 +++++++-
 innfeed/imap_connection.c |    4 ++--
 2 files changed, 9 insertions(+), 3 deletions(-)

Modified: doc/pod/news.pod
===================================================================
--- doc/pod/news.pod    2013-06-25 17:14:34 UTC (rev 9493)
+++ doc/pod/news.pod    2013-06-25 17:27:13 UTC (rev 9494)
@@ -152,7 +152,13 @@
 
 =item *
 
-Fix a Perl warning in B<inncheck>; using C<defined(@array)> has been
+Fixed a buffer overflow when using B<imapfeed> with more than a million
+commands during the same IMAP session.  Thanks to David Binderman for
+the bug report.
+
+=item *
+
+Fixed a Perl warning in B<inncheck>; using C<defined(@array)> has been
 deprecated since S<Perl 5.16>.
 
 =item *

Modified: innfeed/imap_connection.c
===================================================================
--- innfeed/imap_connection.c   2013-06-25 17:14:34 UTC (rev 9493)
+++ innfeed/imap_connection.c   2013-06-25 17:27:13 UTC (rev 9494)
@@ -343,7 +343,7 @@
     int imap_disconnects;
     char *imap_tofree_str;
 
-    char imap_currentTag[IMAP_TAGLENGTH];
+    char imap_currentTag[IMAP_TAGLENGTH+1];
     int  imap_tag_num;
 
     /* Timer for the max amount of time to wait for a response from the
@@ -2383,7 +2383,7 @@
 
 static void imap_GetTag(connection_t *cxn)
 {
-    sprintf(cxn->imap_currentTag,"%06d",cxn->imap_tag_num);
+    snprintf(cxn->imap_currentTag, IMAP_TAGLENGTH+1, "%06d", 
cxn->imap_tag_num);
     cxn->imap_tag_num++;
     if (cxn->imap_tag_num >= 999999)
     {



------------------------------

Message: 4
Date: Tue, 25 Jun 2013 10:27:44 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: branches/2.5 (doc/pod/news.pod
        innfeed/imap_connection.c)
Message-ID: <20130625172744.dd29a67...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:27:44
  Author: iulius
Revision: 9495

imapfeed:  fix buffer overflow

Fixed a buffer overflow when using imapfeed with more than a million
commands during the same IMAP session.

Thanks to David Binderman for having reported the issue.

Modified:
  branches/2.5/doc/pod/news.pod
  branches/2.5/innfeed/imap_connection.c

---------------------------+
 doc/pod/news.pod          |    8 +++++++-
 innfeed/imap_connection.c |    4 ++--
 2 files changed, 9 insertions(+), 3 deletions(-)

Modified: doc/pod/news.pod
===================================================================
--- doc/pod/news.pod    2013-06-25 17:27:13 UTC (rev 9494)
+++ doc/pod/news.pod    2013-06-25 17:27:44 UTC (rev 9495)
@@ -33,7 +33,13 @@
 
 =item *
 
-Fix a Perl warning in B<inncheck>; using C<defined(@array)> has been
+Fixed a buffer overflow when using B<imapfeed> with more than a million
+commands during the same IMAP session.  Thanks to David Binderman for
+the bug report.
+
+=item *
+
+Fixed a Perl warning in B<inncheck>; using C<defined(@array)> has been
 deprecated since S<Perl 5.16>.
 
 =item *

Modified: innfeed/imap_connection.c
===================================================================
--- innfeed/imap_connection.c   2013-06-25 17:27:13 UTC (rev 9494)
+++ innfeed/imap_connection.c   2013-06-25 17:27:44 UTC (rev 9495)
@@ -343,7 +343,7 @@
     int imap_disconnects;
     char *imap_tofree_str;
 
-    char imap_currentTag[IMAP_TAGLENGTH];
+    char imap_currentTag[IMAP_TAGLENGTH+1];
     int  imap_tag_num;
 
     /* Timer for the max amount of time to wait for a response from the
@@ -2383,7 +2383,7 @@
 
 static void imap_GetTag(connection_t *cxn)
 {
-    sprintf(cxn->imap_currentTag,"%06d",cxn->imap_tag_num);
+    snprintf(cxn->imap_currentTag, IMAP_TAGLENGTH+1, "%06d", 
cxn->imap_tag_num);
     cxn->imap_tag_num++;
     if (cxn->imap_tag_num >= 999999)
     {



------------------------------

Message: 5
Date: Tue, 25 Jun 2013 10:40:26 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: trunk (lib/clientactive.c nnrpd/misc.c
        nnrpd/perl.c)
Message-ID: <20130625174026.b343a67...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:40:26
  Author: iulius
Revision: 9496

fix a few resource leaks

A few files were remaining open.

Thanks to David Binderman for having reported the issue.

Modified:
  trunk/lib/clientactive.c
  trunk/nnrpd/misc.c
  trunk/nnrpd/perl.c

--------------------+
 lib/clientactive.c |    1 +
 nnrpd/misc.c       |    3 +++
 nnrpd/perl.c       |    5 +++++
 3 files changed, 9 insertions(+)

Modified: lib/clientactive.c
===================================================================
--- lib/clientactive.c  2013-06-25 17:27:44 UTC (rev 9495)
+++ lib/clientactive.c  2013-06-25 17:40:26 UTC (rev 9496)
@@ -74,6 +74,7 @@
        if (strcmp(CApathname, pathname) == 0)
             CAclose();
        errno = oerrno;
+        fclose(F);
        return NULL;
     }
 

Modified: nnrpd/misc.c
===================================================================
--- nnrpd/misc.c        2013-06-25 17:27:44 UTC (rev 9495)
+++ nnrpd/misc.c        2013-06-25 17:40:26 UTC (rev 9496)
@@ -335,6 +335,7 @@
      if (fgets(buff,SMBUF,fp) == NULL) {
        syslog(L_ERROR, "%s Error reading '%s': %s",
               Client.host, path, strerror(errno));
+       fclose(fp);
        return 0;
      }
      *lastpost = atol(buff);
@@ -342,6 +343,7 @@
      if ((s = strchr(buff,',')) == NULL) {
        syslog(L_ERROR, "%s bad data in postrec file: '%s'",
               Client.host, buff);
+       fclose(fp);
        return 0;
      }
      s++; *lastsleep = atol(s);
@@ -349,6 +351,7 @@
      if ((s = strchr(s,',')) == NULL) {
        syslog(L_ERROR, "%s bad data in postrec file: '%s'",
               Client.host, buff);
+       fclose(fp);
        return 0;
      }
      s++; *lastn = atol(s);

Modified: nnrpd/perl.c
===================================================================
--- nnrpd/perl.c        2013-06-25 17:27:44 UTC (rev 9495)
+++ nnrpd/perl.c        2013-06-25 17:40:26 UTC (rev 9496)
@@ -217,6 +217,11 @@
 
     if (buf[0] != '\0')
         return buf;
+
+#ifdef DEBUG_MODIFY
+    fclose(flog);
+#endif /* DEBUG_MODIFY */
+
     return NULL;
 }
 



------------------------------

Message: 6
Date: Tue, 25 Jun 2013 10:40:59 -0700 (PDT)
From: INN Commit <r...@isc.org>
To: inn-committ...@isc.org
Subject: INN commit: branches/2.5 (lib/clientactive.c nnrpd/misc.c
        nnrpd/perl.c)
Message-ID: <20130625174059.5e7b067...@hope.eyrie.org>

    Date: Tuesday, June 25, 2013 @ 10:40:59
  Author: iulius
Revision: 9497

fix a few resource leaks

A few files were remaining open.

Thanks to David Binderman for having reported the issue.

Modified:
  branches/2.5/lib/clientactive.c
  branches/2.5/nnrpd/misc.c
  branches/2.5/nnrpd/perl.c

--------------------+
 lib/clientactive.c |    1 +
 nnrpd/misc.c       |    3 +++
 nnrpd/perl.c       |    5 +++++
 3 files changed, 9 insertions(+)

Modified: lib/clientactive.c
===================================================================
--- lib/clientactive.c  2013-06-25 17:40:26 UTC (rev 9496)
+++ lib/clientactive.c  2013-06-25 17:40:59 UTC (rev 9497)
@@ -74,6 +74,7 @@
        if (strcmp(CApathname, pathname) == 0)
             CAclose();
        errno = oerrno;
+        fclose(F);
        return NULL;
     }
 

Modified: nnrpd/misc.c
===================================================================
--- nnrpd/misc.c        2013-06-25 17:40:26 UTC (rev 9496)
+++ nnrpd/misc.c        2013-06-25 17:40:59 UTC (rev 9497)
@@ -335,6 +335,7 @@
      if (fgets(buff,SMBUF,fp) == NULL) {
        syslog(L_ERROR, "%s Error reading '%s': %s",
               Client.host, path, strerror(errno));
+       fclose(fp);
        return 0;
      }
      *lastpost = atol(buff);
@@ -342,6 +343,7 @@
      if ((s = strchr(buff,',')) == NULL) {
        syslog(L_ERROR, "%s bad data in postrec file: '%s'",
               Client.host, buff);
+       fclose(fp);
        return 0;
      }
      s++; *lastsleep = atol(s);
@@ -349,6 +351,7 @@
      if ((s = strchr(s,',')) == NULL) {
        syslog(L_ERROR, "%s bad data in postrec file: '%s'",
               Client.host, buff);
+       fclose(fp);
        return 0;
      }
      s++; *lastn = atol(s);

Modified: nnrpd/perl.c
===================================================================
--- nnrpd/perl.c        2013-06-25 17:40:26 UTC (rev 9496)
+++ nnrpd/perl.c        2013-06-25 17:40:59 UTC (rev 9497)
@@ -217,6 +217,11 @@
 
     if (buf[0] != '\0')
         return buf;
+
+#ifdef DEBUG_MODIFY
+    fclose(flog);
+#endif /* DEBUG_MODIFY */
+
     return NULL;
 }
 



------------------------------

_______________________________________________
inn-committers mailing list
inn-committers@lists.isc.org
https://lists.isc.org/mailman/listinfo/inn-committers

End of inn-committers Digest, Vol 52, Issue 6
*********************************************

Reply via email to