Article View: demon.ip.support.pc
Article #736Buffer overflows in KA9Q (was: How long do we get scanned ...)
From: Brian {Hamilton Kelly}
Date: Thu, 23 Aug 2001 00:59
Date: Thu, 23 Aug 2001 00:59
55 lines
3852 bytes
3852 bytes
In article <20010822.0706.18144snz@twoplaces.co.uk>
simon@twoplaces.co.uk "Simon Turner" writes:
> On Monday, in article <998341857snz@dsl.co.uk> bhk@dsl.co.uk
> "Brian {Hamilton Kelly}" wrote:
>
> > Niel Kempson's revision of the KA9Q/2 port (wherein he fixed loads of
> > buffer allocation bugs that the DOS version was blissfully ignoring).
> > Looks like he might have introduced one here, though :-(
>
> I doubt he introduced it; most of the DIS suite was riddled with these
> "fgets() always returns a complete line" assumptions. (I've only just
> finished nailing them in PCOak.)
I should have said "MISSed one here". I'm sure Niel wouldn't have
introduced one.
> Is the source for this version available? And does anyone have the
> tools to compile the OS/2 version?
Niel's version is on the Demon ftp server; I also have a copy. Niel did
a LOT of work circa 1996, finding many of the buffer overflows and other
bugs (which caused proper run-time errors under the tighter bounds
checking of OS/2) and fed these back to Malcolm at the time. Indeed, his
version with its conditional compilations arguably /ought/ to have become
the datum from which other versions were developed.
Sadly, his last revision (05-Aug-1996) predates the discovery of such
infelicities as the multiple SMTP servers sharing a single context if a
rejection is generated, which can lead to phantom bounces, etc.
AIUI, Niel no longer has the requisite licensed M$ C++ V6.0 compiler;
indeed, I don't believe he still runs OS/2. I only have the gcc
compiler, and have fought shy of attempting to recompile under it.
I'm cross-posting this thread to dis.os2: it'll make a change for
anything other than spam to appear therein :-)
> One thought occurs to me: this wouldn't be a problem if you were to
> use one of the (vastly superior) JLW versions of Snews, which fold the
> "References:" field to avoid long line problems like this. If you're
> using a vanilla Demon offering, one of John's DOS versions should drop
> in happily.
Yes, I had been using one of John's versions of SNews during 1998--99,
but reverted to the demi-official (although STILL only "beta") offering
from Richard Clayton when that belatedly appeared. ISTR that John's own
advice was to wait until he started writing extensions to that version
before using his versions again, and I sort-of never "caught up" again.
--
Brian {Hamilton Kelly} bhk@dsl.co.uk
"We have gone from a world of concentrated knowledge and wisdom to one of
distributed ignorance. And we know and understand less while being incr-
easingly capable." Prof. Peter Cochrane, formerly of BT Labs
Technical Details
Message-ID:
<998528361snz@dsl.co.uk>Path:
arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!mail2news.demon.co.uk!not-for-mailReferences:
<1eyc3hg.1pp1imj1rrn7lyN%{$PW$}@womar.co.uk> <20010822.0706.18144snz@twoplaces.co.uk>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fb525,1869bc13a2d94352
X-Google-Attributes: gidfb525,public
X-Google-Thread: 104dc3,3bd8e1a55ad7f59b,start
X-Google-Attributes: gid104dc3,public
X-Google-ArrivalTime: 2001-08-22 18:43:09 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!mail2news.demon.co.uk!not-for-mail
From: bhk@dsl.co.uk (Brian {Hamilton Kelly})
Newsgroups: demon.ip.support.pc,demon.ip.support.os2
Subject: Buffer overflows in KA9Q (was: How long do we get scanned ...)
Date: Thu, 23 Aug 2001 00:59:21 GMT
Organization: Dragonhill Systems Ltd
Message-ID: <998528361snz@dsl.co.uk>
References: <1eyc3hg.1pp1imj1rrn7lyN%{$PW$}@womar.co.uk> <20010822.0706.18144snz@twoplaces.co.uk>
X-Trace: mail2news.demon.co.uk 998530935 mail2news:13238 mail2news mail2news.demon.co.uk
X-Complaints-To: abuse@demon.net
X-Mail2News-Path: news.demon.net!dsl.demon.co.uk
X-Newsreader: Demon Internet Simple News v1.31
Lines: 56