bin/173041: mailx(1) can be fooled to join messages

[Steffen]

>Number:         173041
>Category:       bin
>Synopsis:       mailx(1) can be fooled to join messages
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Oct 24 22:10:01 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Steffen
>Release:        9.0
>Organization:
>Environment:
FreeBSD fbsd9 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:46:30 UTC 2012     root at farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64
>Description:
When "e"diting a MBOX message mail(1) will place the entire message in the editor, i.e., including the separating newline.
If that newline is removed the edited message will be joined with the message before it.
(The good news is that this can be reversed just the same way.)
>How-To-Repeat:
mail -f the following MBOX and "e"dit the first message by just stripping off the final newline.


>From S-Postman Thu May 10 20:40:54 2012
From: <1234567890 at abc.com>
To: <recei at ver.com>
Subject: Example mail
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: RO


I agree it has nothing to do with tz, so wouldn't it have been more conside=
rate not to send it?


>From S-Postman Thu May 10 20:40:54 2012
From: <1234567890 at abc.com>
To: <recei2 at ver2.com>
Subject: Example mail2
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: O


I agree it has nothing to do with tz, so wouldn't it have been more conside=
rate not to send it?


>Fix:
I've fixed that for S-nail(1) like follows, though it is hacky yet.
This patch will most likely not apply to FreeBSD mail(1).

--- /Users/steffen/tmp/f.new	2012-10-24 23:50:48.000000000 +0200
+++ /Users/steffen/tmp/f.old	2012-10-24 23:50:34.000000000 +0200
@@ -80,14 +80,12 @@ visual(void *v)
 static int 
 edit1(int *msgvec, int type)
 {
-	int c;
-	int i;
+	int c, i, wb, lastnl;
 	FILE *fp = NULL;
 	struct message *mp;
 	off_t size;
 	char *line = NULL;
 	size_t linesize;
-	int	wb;

 
 	/*
 	 * Deal with each message to be edited . . .
@@ -114,25 +111,35 @@ edit1(int *msgvec, int type)
 		did_print_dot = 1;
 		touch(mp);
 		sigint = safe_signal(SIGINT, SIG_IGN);
-		fp = run_editor(fp, mp->m_size, type,
+		--mp->m_size; /* XXX[edithack] strip final NL */
+		fp = run_editor(fp, -1/*mp->m_size*/, type,
 				(mb.mb_perm & MB_EDIT) == 0 || !wb,
 				NULL, mp, wb ? SEND_MBOX : SEND_TODISP_ALL,
 				sigint);
+		++mp->m_size; /* XXX[edithack] */
 		if (fp != NULL) {
 			fseek(mb.mb_otf, 0L, SEEK_END);
 			size = ftell(mb.mb_otf);
 			mp->m_block = mailx_blockof(size);
 			mp->m_offset = mailx_offsetof(size);
-			mp->m_size = fsize(fp);
 			mp->m_lines = 0;
 			mp->m_flag |= MODIFY;
 			rewind(fp);
+			lastnl = 0;
+			size = 0;
 			while ((c = getc(fp)) != EOF) {
-				if (c == '\n')
+				if ((lastnl = c == '\n'))
 					mp->m_lines++;
 				if (putc(c, mb.mb_otf) == EOF)
 					break;
+				++size;
 			}
+			/* MBOX finalize XXX[edithack] is this always MBOX? */
+			if (! lastnl && putc('\n', mb.mb_otf) != EOF)
+				++size;
+			if (putc('\n', mb.mb_otf) != EOF)
+				++size;
+			mp->m_size = (size_t)size;/*XXX[edithack] inc.MBOX?!? */
 			if (ferror(mb.mb_otf))

>Release-Note:
>Audit-Trail:
>Unformatted: