>Number:         3463
>Category:       bin
>Synopsis:       tilde escape bug in mail(1)
>Confidential:   yes
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr  7 22:50:02 1997
>Last-Modified:
>Originator:     Matt Power
>Organization:
	MIT
>Release:        NetBSD 1.2D
>Environment:
System: NetBSD zygorthian-space-raiders 1.2D NetBSD 1.2D (TELEGENIC) #5: Tue Apr 1 22:43:02 EST 1997 mycroft@zygorthian-space-raiders:/u2/sys-virgin/src/sys/arch/i386/compile/TELEGENIC i386


>Description:
	mail(1) states that "Tilde escapes are only recognized at the
	beginning of lines." The behavior I see is that tilde escapes
	are also recognized at (at least) the 1024th character of a
	line. Thus, there's a risk that users typing in mail messages
	with long lines may find that mail behaves unexpectedly.
>How-To-Repeat:
	% /usr/bin/mail -s test /tmp/testmail
	[type in the character sequence "1234567890" 102 times,
	followed by the character sequence "123~r /etc/hosts",
	followed by a newline]
	
	This results in the text "/etc/hosts" being printed to the
	terminal. When the message is sent, a file named
	/tmp/testmail is created that includes the contents of the
	/etc/hosts file.
>Fix:
>Audit-Trail:
>Unformatted: