[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[leafnode-list] Bug in texpire



Hello

Last night I stepped into a bug in texpire, or more precise in
configutil.c.

I wanted one newsgroup to never expire, so I set the expiretime to
some astronomical value (in my case 36500 for 100 Years).  This led
into an overflow of the expiretime-variable, so the next time texpire
was run, it wiped out the complete newsgroup.

The problem is, that in configutil.c the expire times are not checked
against overflows.  I have written a small patch to fix this problem
(it's against version 1.9.12, though it should work with other
versions as well):

---------- snip ----------
diff -U 3 -r leafnode-1.9.12.orig/configutil.c leafnode-1.9.12/configutil.c
--- leafnode-1.9.12.orig/configutil.c	Wed Mar 29 15:42:50 2000
+++ leafnode-1.9.12/configutil.c	Sat Apr  8 11:19:15 2000
@@ -166,9 +166,12 @@
 		}
 	    }
 	    else if ( strcmp ( "expire", param ) == 0 ) {
-	        expire = time(NULL)-(time_t)( SECONDS_PER_DAY *atol( value ));
+                int exp = atol( value );
+                if ( exp >= ((INT_MAX / SECONDS_PER_DAY) - 1) )
+                    exp = (INT_MAX / SECONDS_PER_DAY) - 1;
+	        expire = time(NULL)-(time_t)( SECONDS_PER_DAY * exp );
 		if ( debugmode )
-		    syslog( LOG_DEBUG, "config: expire is %s days", value);
+		    syslog( LOG_DEBUG, "config: expire is %d days", exp);
 	    }
 	    else if ( strcmp ( "filterfile", param ) == 0 ) {
 		if ( debugmode )
@@ -244,7 +247,10 @@
 		while ( isspace((unsigned char)*m) )
 		    m++;
 		if ( m && *m ) {
-		    i = time(NULL)-(time_t)( SECONDS_PER_DAY *atol(value));
+                    int exp = atol( value );
+                    if ( exp >= ((INT_MAX / SECONDS_PER_DAY) - 1) )
+                        exp = (INT_MAX / SECONDS_PER_DAY) - 1;
+		    i = time(NULL)-(time_t)( SECONDS_PER_DAY * exp);
                     ent = (struct expire_entry *)
                            malloc( sizeof(struct expire_entry) );
                     ent->group = strdup(m);
@@ -253,8 +259,8 @@
                     prev = ent;
 		    if ( debugmode )
 		        syslog( LOG_DEBUG,
-				"config: groupexpire for %s is %s days",
-				m, value);
+				"config: groupexpire for %s is %d days",
+				m, exp);
 		}
             }
 	    else if ( ( strcmp( "maxage", param ) == 0 ) ||
---------- snip ----------

It is not very good tested till now, but I don't think I've missed
something.  Maybe you can check it and give me feedback if I'm right.

CU, Andreas

-- 
This process can check if this value is zero, and if it is, it does
something child-like.
                -- Forbes Burkowski, CS 454, University of Washington

-- 
leafnode-list@xxxxxxxxxxxxxxxxxxxxxxxxxxxx -- mailing list for leafnode
To unsubscribe, send mail with "unsubscribe" in the subject to the list