Re: KSR[T] Advisory #6: deliver

KSR's proposed patch to Deliver has a bug:

According to KSR[T]:
> + char token[BUFSIZ]; /* Probably paranoid. */
>
> + while (isascii(*lexptr) && isalpha(*lexptr) && i < BUFSIZ)
> token[i++] = *lexptr++;
> token[i] = '\0';

Buffer overrun is possible here.

I suggest anyone who uses Deliver just get the current tarball:

    http://www.pobox.com/~chip/deliver-2.1.13.tar.gz

--
Chip Salzenberg               - a.k.a. -                <chip_at_pobox.com>
 "I stopped that bus and I saved them kids!" "All except one -- the one
you let drive!" "He showed me his license..." "He was seven!!!" // MST3K