To: submit@bugs.debian.org
From: pmaydell@chiark.greenend.org.uk
Subject: trn: bug in the % interpolation code...
Date: Thu, 18 Nov 1999 00:10:44 +0000
Sender: pm215@watchdragon.demon.co.uk
Message-Id: <E11oF9w-0001qf-00@watchdragon.demon.co.uk>

Package: trn
Version: 3.6-12

[ This would appear to have been fixed in trn4, but since Debian
provides trn3.6 I'm going to report this bug anyway :-> ]

If you attempt to use the following MAILHEADER environment
variable with trn, then when you reply (R) to the message
the headers have a random line from your enviroment
appended just before the 'in article foo' line...

mnementh$  export MAILHEADER='To: %t
Subject: %(%i=^$?:Re: %S
%(%{REPLYTO}=^$:Reply-To: %{REPLYTO}
)Newsgroups: %n
In-Reply-To: %i)
%(%[references]=^$?:References: %[references]
)Organization: %o
Cc: 
Bcc: \n\n'

I've run trn through a debugger, and this is occurring because the
code that parses strings and does %-interpolation is at some point
stepping its pointer into the string off the end...
Since Linux stores the environment as 'var=value\0var=value\0...'
the interpolation code winds up adding the next var=value string
in the environment after MAILHEADER.

I suspect this MAILHEADER of actually being buggy (which is odd,
because it's what the manpage claims is the default, modulo typos).

In any case, trn shouldn't walk off the end of the MAILHEADER
environment string -- this could theoretically be a segfault on 
platforms which implement getenv differently...

Peter Maydell