From owner-freebsd-ports@FreeBSD.ORG Wed Jan 26 10:54:41 2005 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D8C1616A4CF; Wed, 26 Jan 2005 10:54:41 +0000 (GMT) Received: from mail.dt.e-technik.uni-dortmund.de (mail.dt.e-technik.Uni-Dortmund.DE [129.217.163.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 10DCA43D2F; Wed, 26 Jan 2005 10:54:41 +0000 (GMT) (envelope-from matthias.andree@gmx.de) Received: from localhost (localhost [127.0.0.1])5B53244236; Wed, 26 Jan 2005 11:54:40 +0100 (CET) Received: from mail.dt.e-technik.uni-dortmund.de ([127.0.0.1]) by localhost (krusty [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 20985-05-3; Wed, 26 Jan 2005 11:54:39 +0100 (CET) Received: from m2a2.dyndns.org (p54854E9E.dip.t-dialin.net [84.133.78.158]) 5254B44235; Wed, 26 Jan 2005 11:54:39 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by merlin.emma.line.org (Postfix) with ESMTP id 743DE774F6; Wed, 26 Jan 2005 11:54:38 +0100 (CET) Received: from merlin.emma.line.org ([127.0.0.1]) by localhost (m2a2.dyndns.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 16819-11; Wed, 26 Jan 2005 11:54:37 +0100 (CET) Received: by merlin.emma.line.org (Postfix, from userid 500) id 7E0C077FCC; Wed, 26 Jan 2005 11:54:37 +0100 (CET) From: Matthias Andree To: Michael Sierchio In-Reply-To: <41F6F431.6060005@tenebras.com> (Michael Sierchio's message of "Tue, 25 Jan 2005 17:36:49 -0800") References: <41F6F431.6060005@tenebras.com> Date: Wed, 26 Jan 2005 11:54:37 +0100 Message-ID: User-Agent: Gnus/5.110003 (No Gnus v0.3) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: by amavisd-new at dt.e-technik.uni-dortmund.de cc: ports@freebsd.org cc: lioux@freebsd.org Subject: Re: FreeBSD Port: qmail-1.03_3 X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jan 2005 10:54:42 -0000 Michael Sierchio writes: > You have added a patch which is totally unneccesary, and I > suggest that it be removed: > > in your patch-qmail-local.... > > - while ((k > i) && (cmds.s[k - 1] == ' ') || (cmds.s[k - 1] == '\t')) > + while ((k > i) && ((cmds.s[k - 1] == ' ') || (cmds.s[k - 1] == '\t'))) > > This is totally bogus, the original code is correct. To clarify what we're talking about: 645 { 646 cmds.s[j] = 0; 647 k = j; > 648 while ((k > i) && (cmds.s[k - 1] == ' ') || (cmds.s[k - 1] == '\t')) > 649 cmds.s[--k] = 0; 650 switch(cmds.s[i]) 651 { Your assertion is bogus, the original code is b0rked and has been discussed on the qmail-list several times. && has a higher precedence than || (and if they had the same precedence, it would not matter as these operators are left-to-right associative), hence C will parse the original code on lines 648f. as while (((k > i) && (cmds.s[k - 1] == ' ')) || (cmds.s[k - 1] == '\t')) cmds.s[--k] = 0; The intention however is while ((k > i) && ((cmds.s[k - 1] == ' ') || (cmds.s[k - 1] == '\t'))) (The parentheses around the relations might indeed be dropped however.) Hence the patch is justified as it fixes this bug. The original code can cause a buffer underrun, and, subsequently, a crash of the process. AFAIR, this strikes on ~USER/.qmail* lines (or the first line) consisting solely of TAB followed by an arbitrary combination of TAB and SPACE characters. Not very common though, but happens occasionally depending on the text editor used on those files. > Please do not make changes to contributed code simply because it makes > it easier for you to understand. Please do not flame port maintainers for fixing bugs in upstream code because *you* don't understand the code or the patch. > There is no semantic difference > between the two, ERGO the patch should not exist. Please remove it. Please leave the patch in for the sake of the poor souls who still use this decrepit software. > Shall I file a PR? Please don't. Instead, grab a good C book and read it. Note that my defending the patch does not mean I endorse, recommend or even suggest qmail. That decrepit piece of software has been unmaintained with dozens of known bugs for the better part of a decade now, is not safe to use on softupdates file systems, and it has a considerable collection of other bugs, some of them deliberate violation of standards (RFC-1652). People ought to look at Postfix, Exim and Courier and perhaps a handful of other MTAs before settling on qmail. -- Matthias Andree