Subject: bin/3463: tilde escape bug in mail(1)
To: None <>
From: None <>
List: netbsd-bugs
Date: 04/08/1997 01:42:23
>Number:         3463
>Category:       bin
>Synopsis:       tilde escape bug in mail(1)
>Confidential:   yes
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr  7 22:50:02 1997
>Originator:     Matt Power
>Release:        NetBSD 1.2D
System: NetBSD zygorthian-space-raiders 1.2D NetBSD 1.2D (TELEGENIC) #5: Tue Apr 1 22:43:02 EST 1997 mycroft@zygorthian-space-raiders:/u2/sys-virgin/src/sys/arch/i386/compile/TELEGENIC i386

	mail(1) states that "Tilde escapes are only recognized at the
	beginning of lines." The behavior I see is that tilde escapes
	are also recognized at (at least) the 1024th character of a
	line. Thus, there's a risk that users typing in mail messages
	with long lines may find that mail behaves unexpectedly.
	% /usr/bin/mail -s test /tmp/testmail
	[type in the character sequence "1234567890" 102 times,
	followed by the character sequence "123~r /etc/hosts",
	followed by a newline]
	This results in the text "/etc/hosts" being printed to the
	terminal. When the message is sent, a file named
	/tmp/testmail is created that includes the contents of the
	/etc/hosts file.