NetBSD Problem Report #47098

From www@NetBSD.org  Sat Oct 20 21:23:11 2012
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	by www.NetBSD.org (Postfix) with ESMTP id 7D03A63E61C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 20 Oct 2012 21:23:11 +0000 (UTC)
Message-Id: <20121020212310.E355C63DFAE@www.NetBSD.org>
Date: Sat, 20 Oct 2012 21:23:10 +0000 (UTC)
From: sdaoden@NetBSD.org
Reply-To: sdaoden@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: mail(1): SEGV with bad globbed file argument
X-Send-Pr-Version: www-1.0

>Number:         47098
>Category:       bin
>Synopsis:       mail(1): SEGV with bad globbed file argument
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 20 21:25:00 +0000 2012
>Closed-Date:    Mon Feb 25 08:35:57 +0000 2013
>Last-Modified:  Mon Feb 25 08:35:57 +0000 2013
>Originator:     Steffen "Daode" Nurpmeso
>Release:        6.0_RC2
>Organization:
>Environment:
>Description:
outof(): expand() may return NULL, but that isn't checked - SEGV.
>How-To-Repeat:
echo au | mail -s boom '"./bautz'
>Fix:
Use S-nail(1).
.-------)

diff --git a/src/usr.bin/mail/names.c b/src/usr.bin/mail/names.c
index f5e5d58..fc214aa 100644
--- a/src/usr.bin/mail/names.c
+++ b/src/usr.bin/mail/names.c
@@ -347,6 +347,12 @@ outof(struct name *names, FILE *fo, struct header *hp)
                        free_child(pid);
                } else {
                        int f;
+                       if (fname == NULL) {
+                               warnx("Filename expansion of %s failed",
+                                       np->n_name);
+                               senderr++;
+                               goto cant;
+                       }
                        if ((fout = Fopen(fname, "a")) == NULL) {
                                warn("%s", fname);
                                senderr++;

>Release-Note:

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47098 CVS commit: src/usr.bin/mail
Date: Sat, 20 Oct 2012 21:11:24 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sun Oct 21 01:11:23 UTC 2012

 Modified Files:
 	src/usr.bin/mail: names.c

 Log Message:
 PR/47098: Steffen "Daode" Nurpmeso: mail(1): SEGV with bad globbed file argument


 To generate a diff of this commit:
 cvs rdiff -u -r1.29 -r1.30 src/usr.bin/mail/names.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 25 Feb 2013 08:35:57 +0000
State-Changed-Why:
christos committed it back in october


>Unformatted:

Home	PR Database Search