@MSGID: <wwvjzsrk83f.fsf@LkoBDZeT.terraraq.uk>
b0bc3425
@REPLY: 1@dont-email.me> f6ddb83e
@REPLYADDR Richard Kettlewell
<invalid@invalid.invalid>
@REPLYTO 2:5075/128 Richard Kettlewell
@CHRS: CP866 2
@RFC: 1 0
@RFC-Message-ID:
<wwvjzsrk83f.fsf@LkoBDZeT.terraraq.uk>
@RFC-References: 1@dont-email.me>
<ygamsxoixhx.fsf@akutech.de>4@dont-email.me> <ygail8biyxm.fsf@akutech.de>1@dont-email.me>
@TZUTC: 0100
@PID: Gnus/5.13 (Gnus v5.13) Emacs/27.1
(gnu/linux)
@TID: FIDOGATE-5.12-ge4e8b94
The Natural Philosopher <tnp@invalid.invalid> writes:
> dir = opendir(VOLATILE_DIR);
>
> if(!dir)
> return;
> while ((dp = readdir (dir)) != NULL)
> {
> filename=dp->d_name;
> // skip known bollocks
> if(!strcmp(filename, "." ) || !strcmp(filename, ".." )
> || !strcmp(filename, "relays.dat" ))
> continue;
> // construct full path
> sprintf(fullname,"%s/%s",VOLATILE_DIR,filename);

Possible write overrun here.

> stat(fullname,&stats);// get tfile times
> if(time(NULL)-stats.st_ctime >1800) // skip files older than half an hour
> continue;
> len=strlen(filename);
> if(strncmp(filename+len-4, ".dat",4)) // .dat file but not relays.dat
> continue;

Possible read under-run here. (But if it crashes then you`d expect
SIGSEGV rather than SIGABRT, so that`s probably not the issue.)

> fp=fopen(fullname, "r");
> if(fp==0) //file has disappeared?
> continue;
> len=fread(filbuf,1,255,fp);

I don`t think the declaration of filbuf has been posted, so there`s a
possible write overrun if it`s less than 255 bytes.


-- 
https://www.greenend.org.uk/rjk/
--- Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
 * Origin: terraraq NNTP server (2:5075/128)
SEEN-BY: 5001/100 5005/49 5015/255 5019/40 5020/715
848 1042 4441 12000
SEEN-BY: 5030/49 1081 5058/104 5075/128
@PATH: 5075/128 5020/1042 4441