From:	SMTP%"terry@SPCVXB.SPC.EDU" 28-JAN-1994 09:28:40.30
To:	EVERHART
CC:	
Subj:	Another buffer overflow bug (+ fix)

Message-Id: <9401281039.AA27646@uu7.psi.com>
Date:         Fri, 28 Jan 1994 06:50:17 GMT
Reply-To: "Terry Kennedy, Operations Mgr." <terry@SPCVXB.SPC.EDU>
Sender: ANU-NEWS Discussion <ANU-NEWS@VM1.NoDak.EDU>
Comments:     Warning -- original Sender: tag was news@SPCUNA.SPC.EDU
From: "Terry Kennedy, Operations Mgr." <terry@SPCVXB.SPC.EDU>
Organization: St. Peter's College, US
Subject:      Another buffer overflow bug (+ fix)
To: Multiple recipients of list ANU-NEWS <ANU-NEWS@VM1.NoDak.EDU>

  One of my downstream nodes commented that I was sending them "zillions
of tiny batch files". After a good deal of investigation, this turns out
to be another case of not checking for string lengths overflowing buffers
in News.

  The scenario goes like this: in NEWSDIST.C, in sys_remote_send, News
fetches the size of the item being added into a struct stat_t. Later on
in sys_remote_send, path_match is called, which attempts to copy the
path into some auto buffers of size 256. Unfortunately, there's no length
check, so a path > 256 will overflow and corrupt the stat_t infile_stat
struct, which is also auto and is contiguous with the path buffers. Thus,
_really_ big numbers (4 bytes of ASCII text!) land in the infile_stat.
st_size cell, causing News to go "Whoops! That won't fit in this batch
file, time to open a new file". Wrong-o.

  Rather than figure out all the places where buffers are under-allocated,
I slapped a quick fix in (attached below). Somebody really ought to look
at this. It would be interesting to see how long News would run under
something like Purify (does that exist for VMS?).

*** newsdist.c_save
--- newsdist.c
**************
*** 1056,1063
         *test_node;
  {
  #if DIST_PATH_CHECK
!   char match_node[NODE_SIZE];
!   char lpath[NODE_SIZE];

    strcpy(lpath,path);
    lower_case(lpath);
--- 1056,1068 -----
         *test_node;
  {
  #if DIST_PATH_CHECK
! /* tmk change
!  * char match_node[NODE_SIZE];
!  * char lpath[NODE_SIZE];
!  * tmk change */
!
!   char match_node[1024];
!   char lpath[1024];

    strcpy(lpath,path);
    lower_case(lpath);

        Terry Kennedy           Operations Manager, Academic Computing
        terry@spcvxa.bitnet     St. Peter's College, Jersey City, NJ USA
        terry@spcvxa.spc.edu    +1 201 915 9381
