🚀 go-pugleaf

In article <kTxWrtCMXwryEA8l@turnpike.com>
           richard@turnpike.com "Richard Clayton" writes:

> In article <850295867snz@dsl.co.uk>, Brian {Hamilton Kelly}
> <bhk@dsl.co.uk> writes
> 
> >Paul (and anyone else using OASIS or similar),
> >
> >You may want to check your software and/or configuration.  The original
> >thread, to which you've posted three follow-ups, had a title
> >Subject: NYNEX and 0845 charges - 50% higher than local rates!
> >(in case you don't see it, that's a percentage sign after the "50",
> >followed by a space and the word "higher")
> >
> >Somewhere along the way, this has become MIME-encoded
> 
> this wouldn't be necessary, % is part of US-ASCII!

That's what I thought too; but nowadays so many things seem to get
encoded on their way (e.g. as HTTP traffic) that the encoding of plain
ASCII is not unknown :-(

> If you check the articles followed up to, you will find that _all_ of
> the damage was done inside of OASIS :(
> 
> At an educated guess, the subject line is being fed to printf (probably
> to add the "Re:") and the '% hi' within it is causing some random byte
> on the stack to be printed :(   I suspect that a suitable subject line
> with some more interesting characters after the "%" will cause OASIS to
> die especially horribly!

Ah yes, the old "that's already a string, so we'll use it as the format"
syndrome.   How about "%65535s"?  Pretty sure to overrun some structure
or other, even if the "string" that happens to be "pointed to" by stack
data contains a \0, since the width specifier causes padding with blanks.
Then again, a simple "%n" ought to overwrite some random int with a count
of the characters preceding the "%".

> The articles are also missing any References: lines :( so the
> combination of damaged subject with this makes them unthreadable by
> Turnpike ((some of the Unix news readers will find the attribution
> strings within the body and manage that way - but most Usenet readers
> will suffer)).
> 
> The author of "OASIS Daily Net (Atari) v1.35E" has some more development
> work to do :(
> 
> copy and followups to d.i.developers (as an instructive example to
> others)

ROFL!

-- 
Brian {Hamilton Kelly}                                         bhk@dsl.co.uk
                Tony Blair's New Labour: The Windows'95 of Political Parties
             (c/w Plug'n'Pray and a pretence of offering object-orientation)