[Leafnode-announce] PATCH: Leafnode 1.9.54.rel aborts during fetchnews

[Matthias A. <mat...@gm...>]

Dear subscriber,

unfortunately, a bug crept into leafnode 1.9.54 that can cause fetchnews
to consistently abort execution on particular operating systems,
beginninng with the next download of the full newsgroup list.

The bug will only show on computers with a [v]snprintf that leafnode
believed to be broken at compile time. (An upgrade of your operating
system may be advised to fix the [v]snprintf bug independently, check
with your vendor.)

Please apologize the inconvenience that the bug and the remedy may cause.

The problem has been reported (so far) against FreeBSD 5.1 (PR #67111)
which is no longer supported by the FreeBSD security officer. It affects
packages and ports that have been compiled on FreeBSD 4.X before 4.9 or
FreeBSD 5.X before 5.2 (exclusively). Check
http://www.freebsd.org/security/ to find which versions are supported.

Note that the canonical way to install leafnode on FreeBSD is via the
FreeBSD ports system. The leafnode port has been fixed as of version
1.9.54_1.

If you have compiled leafnode yourself from the sources, your option to
fix this particular problem is either of the following two, pick
whichever you're more comfortable with:

1. if you are not familiar with patching:
   upgrade to 1.9.55.rc1 which is available from
   http://home.pages.de/~mandree/leafnode/

2. to save a longer download, just use the patch included below.
   Requires a directory containing the unpacked leafnode 1.9.54 source
   code (you can reuse the existing directory where you compiled 1.9.54
   in to speed things up).

   a. save this mail (just the body!) into the leafnode 1.9.54 source
      code directory, for instance as "fetchnews-fixabort.diff"

   b. cd to the leafnode 1.9.54 source code directory

   c. type: patch -p0 <fetchnews-fixabort.diff

   d. now recompile and reinstall as described in steps 2 and 4 of INSTALL.

   e. Done! Run fetchnews with the options you would normally use to
      catch up, for fetchnews may not have run properly since the 1.9.54
      upgrade.

This is the patch in "context" format, suitable for most patch commands:

diff -c -r1.173 -r1.174
*** fetchnews.c	7 May 2004 08:34:15 -0000	1.173
--- fetchnews.c	24 May 2004 13:23:22 -0000	1.174
***************
*** 1622,1629 ****
  	freelist(groups);
      } else {
  	ln_log(LNLOG_SINFO, LNLOG_CSERVER,
! 	    "%s: getting all newsgroups (debug: active: %p, forceactive: %s)",
! 		current_server->name, (void *)active, forceactive ? "true" : "false");
  	xsnprintf(lineout, SIZE_lineout, "LIST\r\n");
  	putaline();
  	if (nntpreply(current_server) != 215) {
--- 1622,1630 ----
  	freelist(groups);
      } else {
  	ln_log(LNLOG_SINFO, LNLOG_CSERVER,
! 	    "%s: getting all newsgroups (debug: active: %s, forceactive: %s)",
! 		current_server->name,
! 		active ? "set" : "nil", forceactive ? "true" : "false");
  	xsnprintf(lineout, SIZE_lineout, "LIST\r\n");
  	putaline();
  	if (nntpreply(current_server) != 215) {

This mail is unsigned because a cleartext signature would break the
patch for those who don't run GPG and because the alternative PGP/MIME
signature isn't handled yet by sufficiently many mail programs.

If you doubt the patch, grab 1.9.55.rc1 which comes with a detached GPG
signature that you can verify.

Matthias Andree
Leafnode Maintainer