https://gitlab.synchro.net/main/sbbs/-/commit/68762da2e1bcee1f93335059
Modified Files:
src/sbbs3/smbutil.c src/smblib/smballoc.c src/smblib/tests/smballoctest.c
Log Message:
smblib: don't allocate over data or headers the allocation file misses

smb_allocdat() and smb_allochdr() scanned the allocation file for free
blocks until a read came up short and, when that read set EOF rather
than an error, took the scan's position as the end of the file. An
allocation file that read short or empty, as it can over a stalled
network share, therefore placed the new message at block 0, on top of
a live message. The same view made smb_fallocdat() and smb_fallochdr()
append at block 0.

A mail base was found with exactly this: an error notification written
by a Windows host during a loopback CIFS stall was allocated data block
0, already in use, overwriting that message's text; the allocation
record still counted one reference.

The scans now read the length of the allocation file first and treat a
short read before its end as an error. When a new message is appended
rather than placed in free blocks, it now goes after the end of the
data (or header) file if that file is longer than its allocation file
accounts for: blocks past the end of the allocation file are
unaccounted for, not free. smb_allochdr() also gains the maximum header
offset check that the other header allocators have.

smbutil's pack allocates while reading the old data and header files
through the base's file pointers, so it now points them at the new
files for the allocation calls; packed output is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net