Bugzilla Bug 74340

I noticed that the gentoo nbsmtp 0.96 build had a buffer bug when I tried to
send email to several people.  nbsmtp would crash and in the debug info
appended to /var/log/messages I could see a "gethostbyname2_r" recipient and
then garbage.  http://nbsmtp.ferdyx.org/ lists an October 25 2004 0.97 version
that supposedly fixes a recipient buffer bug.  I haven't tried it out, but I
looked at a diff.  There are a bunch of configuration changes but also changes
related to the recipient code.  I think it would be especially important to
incorporate the fixes as soon as possible (assuming they work) for two reasons.
 I don't know but imagine this could be a security issue.  And nbsmtp is the
mta of choice in the gentoo mutt guide
http://www.gentoo.org/doc/en/guide-to-mutt.xml.  Thanks.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

I'm on it

0.97 in portage now, I'll try if it really fixes the problem. (can't now, got
to run, dinner with girlfriend :))) )

Anyway, thanks for reporting.

Note to self: it would be a good idea to get this stable on all arches ASAP

Created an attachment (id=46214) [details]
/var/log/messages from nbsmtp

Thanks for the response.  I had hoped that 0.97 would work right, but it looks
like it breaks in a different way for me than 0.96 did.  Throughout this report
I will be changing names for anonymity's sake but try to at least keep the same
number of letters.  I am assuming 0.97 should be a drop in replacement for 0.96
that just works.

mutt emerge:
[ebuild   R   ] mail-client/mutt-1.5.6-r4  -cjk +crypt -debug -imap -mbox +nls
-nntp +slang +ssl -vanilla 0 kB

nbsmtp emerge:
[ebuild   R   ] mail-mta/nbsmtp-0.97  -debug +ipv6 +ssl 0 kB

mutt sendmail line:
set sendmail="/usr/bin/nbsmtp -D -d myisp1234.com -h smtpauth.myisp1234.com -f
johndoe12345@myisp1234.com -M l -U johndoe12345@myisp1234.com -P 12345678"

Test cases:

1) With mail-mta/nbsmtp-0.96 emerged and sending to one email address (or a
couple addresses), email works just fine.  Refer to attachment for log details
of a successful nbsmtp transaction.

2) Sending to several addresses (about 9 in my example), email fails.  Mutt
reports an error.  You can see in the attached log that there is a buffer
problem and function strings are showing up as recipients.

3) With mail-mta/nbsmtp-0.97 emerged and sending to one email address, email
fails.	So functionality actually got worse for me.  Mutt reports an error. 
Nothing looks wrong in the log except nbsmtp doesn't complete the transaction
(look at the full transaction under 0.96 in the previous log entries).

4) Sending to several addresses (I think I used the same 9 address postponed
email as before), email fails.	Mutt reports an error.	All of the recipients
now look fine.	However, the transaction appears to halt at the same place as
case 3.

So I don't know what steps a gentoo person should take at this point.  I assume
you push it upstream to the nbsmtp author.  I know I could simply drop in a
different smtp app.  As I stated before, I used nbsmtp because it is used in
the gentoo mutt guide http://www.gentoo.org/doc/en/guide-to-mutt.xml.

It looks like I have managed to get 0.97 to work if I deactivate SSL.  So I do
the following:

# USE="debug -ssl" emerge -av =nbsmtp-0.97

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] mail-mta/nbsmtp-0.97  +debug +ipv6 -ssl 0 kB 

And email is sent just fine with about 8 recipients.

I have done testing where I make sure iptables are cleared.  Emerge with ssl
and email fails.  Emerge without ssl and email works.  Email was working (with
a few recipients) under 0.96 with SSL enabled.  There might be some problem
with the program or it could be that I am not using SSL correctly for 0.97. 
I'll try to test more later.

There is a bug on nbsmtp-0.97 handling the nbsmtp_header function if compiled
with SSL but not actually using SSL to connect to the server.

An user sent a patch, I have it on main page [ http://nbsmtp.ferdyx.org ].
Anyway, nbsmtp-0.98 will be released (hopefully) in four hours or so. I'll make
a bug to notify you.

Thanks and I'm open to suggestions and critics :P I want to do this a neat
tool, so any help is apreciated.

Cheers,
Ferdy

David, 0.98 will be on portage mirrors in few hours, the problem is fixed
there. Thanks again, Ferdy.