William Carrel <william(_dot_)carrel(_at_)infospace(_dot_)com> writes:
On Thursday, July 12, 2001, at 05:54 AM, Santiago Vila wrote:
...
I tried to change that line, but my system (Debian GNU/Linux 2.2) does
not have strlcpy:
exopen.o: In function `unique':
[...]/procmail-3.21/src/exopen.c:50: undefined reference to `strlcpy'
That is strlcpy with a lowercase L in the middle. It exists on all the
Debian systems that I have access to. Perhaps you mistyped the name or
a library is required? I find it difficult to fathom that strlcat and
strlcpy wouldn't both be defined in the same library and header files,
but odder things have been known to occur.
Procmail 3.20/3.21 includes an implementation of strlcat() for those
platforms that don't have it in their libc. Those versions of procmail
don't use strlcpy(), so a 'backup' implementation of it was not included.
The next version on the 'main line' of development will do so as it uses
it.
As for the maildir bug: the strlcat()-->strlcpy() change is (almost)
correct. The third argument is also wrong. It should be:
strlcpy(dot+2,hostname(),end-dot-2);
The incorrect limit is not a security risk because procmail includes a few
bytes of extra space at the end of each buffer, so it just runs into that.
To provide a 'safe haven' for those concerned about the instability in
recent versions of procmail while still fixing all known security holes,
some time next week I intend to release version 3.15.2. This will be
version 3.15.1 with *just* security fixes. None of the other changes from
version 3.20/3.21 will be included, not even the maildir naming change.
Philip Guenther
Procmail Maintainer
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail