[net.news] The Article Eater Bug lives!

phil@amdcad.UUCP (Phil Ngai) (10/19/85)

A few months ago, Chuqui was claiming that certain articles with
the right(wrong) characters in their body could upset unbatchers
and cause subsequent articles to be lost.

Although I like Chuqui as much as the next guy (hey Lauren, do you
like Chuqui?) and would hate to admit there could ever be anything of
value in what he says, I have duplicated his findings.

The details of my situation are as follows:

Our news feed from decwrl had been constipated for several days. This
went unnoticed because we have three full-blast feeds and news flow was
thus unaffected. What brought it to my attention was that the
/usr/spool partition was getting unusually full.

For decwrl, we use the bnproc method of batching and unbatching. I got
it from Mark Stein who got it (I think) from John Levine. Although we
run 2.10.3 and prefer that method of batching, decwrl hasn't upgraded
from 2.10.2 yet. So I have only reproduced this problem with bnproc.
It may not affect 2.10.3 batchers. But there are probably enough
people using bnproc to justify posting this. Also, this experience can
be taken as a plea for paranoid software.

When I poked through /usr/spool, I found that the bnproc spool
directory had about 100 batches of news in it. I saw the lock file and
removed it, thinking it had just gotten wedged. Nope. Bnproc would
process a few files and die. And I would get msgs about "Inbound news
is garbled". So I looked at a few batches and sure enough, I had some
cancel msgs with a \377 in them and no trailing newline. I made a copy
of one of the batches and edited out most of the articles, leaving the
cancel msg and two articles after it. When I fed it to bnproc, only
two of the three articles made it, as indicated by looking at
/usr/lib/news/log. And inews again complained, twice, about "Inbound
news is garbled." This was consistently repeatable.

I've still got the test file around but am afraid to post it for fear
some helpless article after mine will get eaten. But the important
thing is, this article eater bug is real. It may be a problem with
bnproc, not rnews, but in any case, it does affect some systems.
I plan to look into this further, if I can find the source for bnproc.
It's so old it may be lost. Sure wish decwrl would upgrade.

-- 
The California Lottery is a tax on the stupid.

 Phil Ngai +1 408 749-5720
 UUCP: {ucbvax,decwrl,ihnp4,allegra}!amdcad!phil
 ARPA: amdcad!phil@decwrl.dec.com

reid@Glacier.ARPA (Brian Reid) (10/19/85)

I have a 0.68-megabyte collection of news that, when batched with 2.10.2
batchnews, will tickle the article-eater bug every time. I have not yet
succeeded in finding a subset of it that also tickles the bug. Various
people such as kre have demanded name-date-place-serialnumber type of proof,
so I've kept quiet about it until I get the time to reduce it to something
tractable. I can induce the failure entirely on Glacier, without involving
decwrl, though the news did all come from decwrl. I have resisted the
temptation to send the entire 680Kbytes to Australia and asking kre to find
it......

Phil Ngai says:
> I sure wish decwrl would upgrade! 

Hey, 2.10.3 is not officially released yet. How can you possibly get on
somebody's case to upgrade to software that is not out of beta test?
You could probably get them to switch to 2.10.2 batchnews for your feed.
-- 
	Brian Reid	decwrl!glacier!reid
	Stanford	reid@SU-Glacier.ARPA