Exmh hangs from BUGTRAQ posts [fix]

[luyer () UCS UWA EDU AU (David Luyer)]

CC'd to welch () acm org   [exmh bug address]
        igor () debian org [exmh debian maintainer]

If URI scanning is enabled in exmh (I'm using version 2.0.2 2/24/98 on
Debian Linux, Tk 8.0, Tcl 8.0), recent BUGTRAQ posts with very long strings
of letters (ie, xxxxxxxx[...]) have caused complete hangs in exmh of around
5 minutes for some messages.  During this time exmh is completely
unresponsive, except to a kill (it doesn't even repaint its display).

Here's a patch to fix the problem;

=================== patch begin =================================
--- uri.tcl     Tue Jun 30 13:23:39 1998
+++ uri.tcl.orig        Tue Jun 30 13:21:08 1998
@@ -324,7 +324,7 @@
     Exmh_Debug "URI_ScanMsg $limit"
     set multiline 0
     set hit 0
-    set Protocol (ftp|http|https|gopher|nntp|telnet|wais|file|prospero|finger|urn|mailto|news|solo|x500)
+#    set protocol (ftp|http|https|gopher|nntp|telnet|wais|file|prospero|finger|urn|mailto|news|solo|x500)
     set protocol {[A-Za-z_]+[-A-Za-z0-9_]*}

     for {set i 0} {[$w compare $i.0 < $limit]} {if {! $hit} {incr i}} {
@@ -417,10 +417,8 @@
             set start [expr [lindex $indices 0] + 1]
             set end [expr [lindex $indices 1] - 1]
            set hit 1
-# fix mailer hangs of up to 5 minutes which were happening due to
-# BUGTRAQ posts with very long strings of xxxxxxxxxxxxxxxxx[...] in
-# them by using $Protocol instead of $protocol.
-        } elseif {[regexp -indices "$Protocol:/+\[^ \n\t\]+\[^ \n\t,\.\)>\'\"\]" \
+
+        } elseif {[regexp -indices "$protocol:/+\[^ \n\t\]+\[^ \n\t,\.\)>\'\"\]" \
                $text indices] == 1} {
            # check for unencapsulated URIs by protocol if no < > present
            Exmh_Debug Regexp4 $indices
=================== patch end ===================================

While there are still, and will probably always be, some obvious ways to
cause the same problem, it fixes the problem for the case of the
semi-frequent BUGTRAQ posts which contain long alphabetic strings with no
breaks.

To fix the general hang/DoS, disable URI scanning or some work has to be
done on the regexps (possibly changing the line
set protocol {[A-Za-z_]+[-A-Za-z0-9_]*}
to
set protocol {[A-Za-z_]+[-A-Za-z0-9_]{,10}}
or however such a regexp would be written in Tcl would help significantly)

David.