[net.news] Path truncation bug discovered and fixed

pag@hao.UUCP (Peter Gross) (10/23/84)

If you are anything like me, <don quasi-respectable SA hat>, you hate
to be accused of propagating a bug that infects the entire known
USENET world.  The infamous "path truncation" bug has been laid at
the doorstep of my site, hao.  Horrors.

The sad truth is that, yes, we have spread the bubonic truncation
plague hither and yon.  Followups and replies are dying everywhere.
Time is running out.  Nerves are frayed.  Well, fear not, friends.
The bug has been found.  The culprit was a change in header.c in
news 2.10.2.  It was subtle enough that it would only likely show
up on PDP-11's.  The offending line of code follows:

		strncpy(hpfield, ptr, BUFLEN);

What happened is that every time a header field was copied, BUFLEN chars
were copied no matter what the size of the field.  Most header fields
are strings of size BUFLEN, but some are longer (Path: and Control:).
Others are shorter.  In the case where the fields are longer, they were
truncated to BUFLEN (128 on pdp11, 256 on other machines); in the case
where they were shorter, other parts of the header were trashed.  (This
may be the source of the "0 Lines" bug -- I haven't checked that one yet).

The solution?  I added an argument to getfield(): the header type.
getfield() now sets the copy size according to type.  For a quick
and dirty fix, just change the strncpy() to a strcpy().  I have
posted the new version of header.c to net.sources.

While I am convinced that this was a bug, I haven't yet received any
articles with paths longer than 128 chars to check on the fix.  The logic in
getfield() was pretty obviously wrong though.

yours for a bug-free USENET,
--peter gross
hao!pag

pag@hao.UUCP (Peter Gross) (10/23/84)

When I posted the above-referenced article, I had not tested my fix
to the path truncation bug since no news had come through with
long paths.  I have now tested it, and it works as predicted.  You
may notice some path-truncated articles emanating from hao after
I posted the fix.  This was due to rnews having gotten unlinked from
inews and the old version being used.   That has all been corrected
now.  To repeat, the fixed version of header.c posted to net.sources
does fix the path truncation bug (and possibly the 0 lines bug).

--peter gross
hao!pag