BUG in art.c:2284 ARTpost() causes core

[Andrew McNamara]

There's a bug in the ARTpost() function - when it sees an article with
a distribution header such as "Distribution: ," (note the comma), the
DISTparse() function returns a distribution[] array with a null pointer
as it's first element (i.e., an empty list). The later call to
MaxLength() in the arguments to sprintf() dereferences this and dies in
flames.

I patched this crudely to get our news servers back up - the patch just
treates this as an empty "Distribution:" header. It might be better to
strip the bogosity altogether to protect unpatched inn's.

--- dist/inn-2.2/innd/art.c       Mon Jan 11 12:38:47 1999
+++ inn-2.2/innd/art.c  Thu Nov 18 16:49:49 1999
@@ -2277,8 +2277,9 @@
     /* If we limit what distributions we get, see if we want this one. */
     p = HDR(_distribution);
     distributions = *p ? CommaSplit(p) : NULL;
-    if (distributions) {
+    if (distributions)
        DISTparse(distributions, &Data);
+    if (distributions && distributions[0]) {
        if (ME.Distributions
         && !DISTwantany(ME.Distributions, distributions)) {
            (void)sprintf(buff, "%d Unwanted distribution \"%s\"",

 ---
Andrew McNamara (System Architect)

connect.com.au Pty Ltd
Lvl 3, 213 Miller St, North Sydney, NSW 2060, Australia
Phone: +61 2 9409 2117, Fax: +61 2 9409 2111