BUG in art.c:2284 ARTpost() causes core

[Don Lewis]

On Nov 18,  5:17pm, Andrew McNamara wrote:
} Subject: BUG in art.c:2284 ARTpost() causes core
} There's a bug in the ARTpost() function - when it sees an article with
} a distribution header such as "Distribution: ," (note the comma), the
} DISTparse() function returns a distribution[] array with a null pointer
} as it's first element (i.e., an empty list). The later call to
} MaxLength() in the arguments to sprintf() dereferences this and dies in
} flames.

I just got bit by this as well.

} I patched this crudely to get our news servers back up - the patch just
} treates this as an empty "Distribution:" header. It might be better to
} strip the bogosity altogether to protect unpatched inn's.

Your patch has a slight memory leak.  Here's my patch (to an old and heavily
patched version of INN) that tosses the article to protect unpatched
downstream servers.  I don't know for sure if my patch works though, since
we haven't been offered any broken articles since I installed the patch.

--- art.c-	Thu Oct 29 02:11:38 1998
+++ art.c	Wed Nov 17 22:09:14 1999
@@ -1887,6 +1887,20 @@
     p = HDR(_distribution);
     distributions = *p ? CommaSplit(p) : NULL;
     if (distributions) {
+      if (distributions[0] == '\0') {
+	(void)sprintf(buff, "%d bogus distribution \"%s\"",
+		NNTP_REJECTIT_VAL,
+		MaxLength(p, p));
+	ARTlog(&Data, ART_REJECT, buff);
+#if	defined(DO_REMEMBER_TRASH)
+        if (Mode == OMrunning && !HISwrite(&Data, ""))
+            syslog(L_ERROR, "%s cant write history %s %m",
+                   LogName, Data.MessageID);
+#endif	/* defined(DO_REMEMBER_TRASH) */
+	DISPOSE(distributions);
+	ARTreject(buff, article);
+	return buff;
+      } else {
 	DISTparse(distributions, &Data);
 	if (ME.Distributions
 	 && !DISTwantany(ME.Distributions, distributions)) {
@@ -1903,6 +1917,7 @@
 	    ARTreject(buff, article);
 	    return buff;
 	}
+      }
     }
     else {
 	Data.Distribution = "?";