I'm inspecting the source to pop_dropcopy (v4.0.3) to see how to
disable bulletins without recompiling. The code that constructs the
path to the bulldb uses sprintf to append "/bulldb" to a possible
user-supplied string. What keeps the user from specifying an
overly-long path in his config file, causing qpopper to crash from a
buffer overrun?

Also, the code that checks for whether to use bulletins
(pop_dropcopy.c, line 1258) checks for a null p->bulldir. Is this set
to NULL when the user specifies an empty string in the config file? Or
is it just set to an empty string? Should that conditional be checking
for an empty string as well?

Ken
mailto:[EMAIL PROTECTED]
http://www.sewingwitch.com/ken/
[If answering a mailing list posting, please don't cc me your reply. I'll take my 
answer on the list.]


Reply via email to