gmane.mail.bogofilter.devel

bogofilter-1.2.2 - new current release

David Relson — 2010-07-09T01:34:12

Bogofilter v1.2.2 is now available.

This release fixes a security fix and several minor bugs and cleanups.

A heap corruption caused by invalid base64 input has been fixed.
A better PRNG is now being used.
Support has been updated for Berkeley 4.8 and 5.0
Minimum supported version of SQLite3 has been bumped.
Miscellaneous clang and compiler warnings have been fixed.

########################################################################

Files are available at http://sourceforge.net/projects/bogofilter for
download.

Here are the md5sums for the release:

0d77f9bf9f73d0555cac751088de6d2e bogofilter-1.2.2-1.src.rpm
4bcabdf8c5e7efefcb508eda7e80eebc bogofilter-1.2.2.tar.bz2
39d27c13eae8a5064d68e20d585e60de bogofilter-1.2.2.tar.gz
91e1e120f7815c66735838f149d4020d bogofilter-db42-1.2.2-1.i586.rpm
2d8923111a5a2d08fb36c5827881d41c bogofilter-db42-static-1.2.2-1.i586.rpm
ef9a99b71e400b1ba5410222e5a9befb bogofilter-sqlite3-1.2.2-1.i586.rpm
79cb331dfa4e4400ef8fb22007a7626e bogofilter-sqlite3-static-1.2.2-1.i586.rpm

########################################################################

Here's the cumulative change log since 1.1.0:

=================
BOGOFILTER NEWS
=================

!!!!!!!! READ THE RELEASE.NOTES !!!!!!!!

This file is in Unicode charset, with UTF-8 encoding.

Sections headed '[Incompat <version>]' and '[Major <version>]'
are particularly important. They describe changes that are
incompatible with earlier releases or are significantly
different.

!!!!!!!! READ THE RELEASE.NOTES !!!!!!!!

-------------------------------------------------------------------------------

1.2.22010-10-08 (released)

2010-07-05
* Use a better PRNG for random sleeps. That is arc4random() where
available, and drand48() elsewhere.

* Assorted fixes for issues found with clang analyzer:
+ Fix a potential NULL deference
+ Fix a potential division by zero
+ Remove dead assignments and increments

* Update Doxyfile and source contrib/bogogrep.c for docs, too.

2010-07-03

* Security bugfix, CVE-2010-2494:
Fix a heap corruption in base64 decoder on invalid input.
Analysis and patch by Julius Plenz <plenz< at >cis.fu-berlin.de>.
Please see doc/bogofilter-SA-2010-01 for details.

2010-04-07

* Updated sendmail milter contrib/bogofilter-milter.pl to v1.??????
(thanks to Jonathan Kamens)

2010-04-01

* Bump supported/minimum SQLite3 versions and warning threshold.
See doc/README.sqlite for details.

* Mark BerkeleyDB 4.8.26 and 5.0.21 supported.

Note that Berkeley DB 5.0's SQLite3 compatibility API is NOT
supported, it causes shifts in scores and write failures under
contention. Bogofilter can use Berkeley DB 5.0's native interface,
and using that is more efficient than the added SQL shim layer.

2010-03-06

* Make t.maint more robust; ignore .ENCODING token. To fix test
failures on, for instance, FreeBSD with unicode enabled.

2010-02-15

* Fix several compiler warnings "array subscript has type 'char'", by
casting the arguments to unsigned char.
A security audit was conducted and showed that all affected
functions either received the relevant input from the user running
bogofilter, or the input had already been pre-validated by the token
lexer.

2010-02-14

* Split error messages for ENOENT and EINVAL into new function.
* Avoid divison by zero in robx computation by checking if there are at
least one ham message and one spam message registered.

2009-08-13

* contrib/spamitarium.pl updated to version 0.4.0
(thanks to Tom Anderson)

2009-08-05

* Updated and integrated Ted Phelps's "Patch to prevent .ENCODING from
being discarded by bogoutil -m" (SourceForge Patch #1743984).
Thanks to Ted for debugging the issue and providing the patch (which
was for bogofilter v1.1.5).

2009-09-15
* Promoted to "stable"

1.2.12009-08-01 (released)

2009-08-01
* Update configure to use "host" rather than "target", to match the
newer autotools cross-build semantics. Untested.
Developers changing the build system and users who build from SVN
will now need automake 1.9 and autoconf 2.60.

2009-07-31
* Fix Christian Frommeyer's MIME decoding bug, Ubuntu/Launchpad Bug
#320829. As a side effect, also fixes misattribution of MIME bodies
as MIME headers with mime: tag. Original bug report:
https://bugs.launchpad.net/ubuntu/+source/bogofilter/+bug/320829

Before this fix, bogofilter did not properly MIME-decode the first
line in a body. This was especially bad with Christian's samples
where the whole body was only one long base64 line.

2009-05-28
* Removed two scripts that are auto-built.
* Added test case for Stephen Davies' Q-P EOL problem (see below).

2009-05-25
* Fixed EOL problem in quoted_printable text. Problem reported by
Stephen Davies and identified by Pavel Kankovsky.

2009-03-28
* Promoted to "stable"

1.2.02009-02-21 (released)

2009-02-20
* Flex-2.5.35 has fix for memory allocation problem in 2.5.4,
2.5.31, and 2.5.33, making bogofilter's flex patch obsolete.

2009-02-12
* Bogofilter now uses listsort in place of qsort.

2009-01-31
* Added token-count=n, token-count-min=n, and token-count-max=n options.
* Minor code cleanups.

2009-01-21

* spamitarium.pl updated to version 0.3.0
(thanks to Tom Anderson)

2009-01-11

* For compatibility with Sun's Sun Studio 12 compiler, provide
a name for the anonymous union in typedef word_t.
Patch provided by Jack Bailey.

2008-10-20

* update bf_compact documentation by removing explicit Berkeley DB
references, as it has been fixed to work with other database drivers
in March 2008.

2008-10-15

* bf_compact, bf_copy and bf_tar now support transformed program names
(fixes Debian Bug#501947).

* Update sqlite3 adaptor to take advantage of sqlite3_prepare_v2()
API function that appeared in SQLite 3.3.9. The new _v2 interface
allows for more specific error messages when executing SQL
statements. Also enable extended result codes for more precise error
reporting.

2008-07-21

* Update doc/integrating-with-postfix: the script now suggests sendmail
-G -i (where -G will be ignored by Postfix before 2.3) to tell
Postfix it's a gateway submission, not an original injection; the
filter pipe(8) magic for master.cf now suggests flags=Rq (was
flags=R), as per Postfix's FILTER_README.

2008-07-09

* Drop support for systems that reverse setvbuf arguments. The last
systems to do that are reported to be shipped in 1987 by the autoconf
manual, so ditch them.

2008-05-18
* Promoted to "stable"

1.1.72008-05-04 (released)

2008-04-30

* Updated sendmail milter contrib/bogofilter-milter.pl to v1.45
(thanks to Jonathan Kamens)

2008-04-28

* Added maildir training info to English and French FAQs.
(thanks to Karl Schmidt and to Mouss)

2008-04-26

* Fix uninitialized variable in lexer.c when unicode is disabled.
Patch provided by Roman Trunov.

2008-04-20

* In process_arg functions use the val parameter rather than optarg.
Patch provided by Roman Trunov.

2008-04-18

* Function process_arg now has the same prototype for
bogofilter, bogolexer, bogoutil, and bogotune. The proper
version is called by function read_config_file for all
programs. Problem reported by Roman Trunov.

2008-04-17

* Update Doxyfile for doxygen v1.5.5

2008-04-16

* Fixed syntax errors in t.valgrind test

2008-03-21

* bf_compact now supports compacting databases that use QDBM, Tokyo
Cabinet or SQLite3 and is covered by the test suite.

2008-03-19

* bf_compact now verifies databases before dumping them, to avoid
getting into an unterminated loop and wasting all diskspace.

* Bogoupgrade now verifies databases before dumping them, to avoid
getting into an unterminated loop and burning all memory or disk
space when the database is corrupt.
This should fix Debian Bug#226643 and Debian Bug#226646.

* Bogoupgrade now uses Pod::Usage to print usage/help, prints error
messages that are a bit more concise and validates arguments a bit
stricter.

2008-02-08

* Bump required sqlite version to 3.5.4, earlier versions could
sometimes corrupt the database. Update install-staticdblibs.sh.
Bogofilter will complain when used with older versions.

2008-01-05

* bf_compact problem fixed. Reported by Thomas Novin.

1.1.62007-11-25 (released)

* Transaction support added for TokyoCabinet datastore.
(thanks to Pierre Habouzit)

* Bump required sqlite version to 3.4.2 and fix related compiler
warnings. Bogofilter will complain when used with older versions.

2007-11-22

* Support for TokyoCabinet datastore added.
(thanks to Pierre Habouzit)

2007-08-14

* doc/README.db was updated to BerkeleyDB 4.6
* doc/README.db: section 3.5 was added, with information on how to
resolve "Logging region out of memory; you may need to increase its
size", section 4.2 now documents set_lg_regionmax.

2007-07-23

* The upstream repository was migrated to SVN.
In order to check the code out, use this command (one line):
svn co https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/ bogofilter

2007-07-22

* The install-staticdblibs.sh script was relicensed under GNU GPL v3,
adjusted to download Berkeley DB 4.2 from oracle.com, adds patch #5,
and updated to build SQLite 3.4.1. In order to for a rebuild of the
updated library, do: rm -rf /opt/db-4.2-lean /opt/sqlite-3-lean
and re-run the script.

* The recommended minimum sqlite3 version is now 3.4.0, bogofilter will
warn if used with older versions. Bugs that could cause database
corruption in rare circumstances have been fixed in sqlite3.
See doc/README.sqlite for details.

* Updated sendmail milter contrib/bogofilter-milter.pl to v1.27
(thanks to Jonathan Kamens)

2007-02-25

* Add '--spam-header-place={header}' to specify header line
before which the X-Bogosity line is placed.

2007-02-14

* Support --db-verify for sqlite3.

* Fix defect where the database verification method would not be called
for traditional Berkeley DB databases. Reported by Eric Wood.

2007-01-28

* Fix test suite for situations where there are blanks in the test or
working directories' names.

* Repair passthrough defect on systems whose standard system library
makes a distinction between text and binary mode in stdio stuff.

1.1.52007-01-14 (released) 2007-01-25 (declared stable)

* Fixed Makefile dependency problem.
(reported by Andras Salamon)
This took several iterations to get right.

2007-01-11

* Fixed block-on-subnets problem.
(thanks to Jack Bailey)

2007-01-10
* Added block-on-subnets regression test.

1.1.42007-01-01 (released)

* Update copyright notices.

2006-12-08

* Add GSL dependency to bogofilter target to support parallel
makes.
(reported by Martin von Gagern)

2006-12-05

* Fixed problem in flex-2.5.4 patch.
(reported by Boris 'pi' Piwinger)

1.1.32006-12-03 (released) 2006-12-20 (declared stable)

* Fixed typo in configure.ac.
(reported by Boris 'pi' Piwinger and Torsten Veller)

1.1.22006-12-02 (released)

2006-12-01

* Revise install-staticlibs.sh's links for retrieving database
tarball and patches.
* Revise make rules for generating statically linked RPM.

2006-11-29

* Provide separate flex patches for 2.5.4 and 2.5.3x

2006-11-26

* Updated file comment for lexer_v3.l and removed unneeded
rules T1, T12, SHORT_TOKEN, and TOKEN_12.
* Miscellaneous minor cleanups of lexer_v3.l classes and rules.
* Patch flex skeleton code problem which can cause a seg-fault.
(reported by Michael Gerdau)

2006-11-21

* Fix processing of "--unicode=no" option.

2006-11-18

* Fix prefixes for ip address and url tokens. Restore colon
that was dropped in token.c edit for bogofilter-1.1.0.

2006-11-04

* Fixed problem parsing message ids, which can cause a
seg-fault on an x86_64.
(reported by Torsten Veller)

2006-10-03

* Added '--ham-true' option for bogofilter (to match docs)

2006-08-26

* FAQ's updated to point to current sylpheed-claws wiki
(thanks to Paul Mangan)

1.1.12006-08-23 (released) 2006-09-01 (declared stable)

2006-08-22

* Added bogofilter-faq-it.html, an Italian translation of the
FAQ (thanks to Marco Bozzolan).

2006-08-10

* Fixed minor header/body multi-word token defect.

1.1.02006-08-09 (released)
_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Re: [patch] Fix possible memory corruption in bogofilter 1.2.1

Matthias Andree — 2010-07-02T00:32:46

Am 28.06.2010, 11:31 Uhr, schrieb Julius Plenz:


Hi Julius,

thank you for your contribution. I'll look at it probably in the course of  
the next week.  For the nonce, I have moved the material into our SVN,  
under contrib/incoming/julius-plenz - but it will not appear in the dist  
tarballs for now.

Best regards

Re: [patch] Fix possible memory corruption in bogofilter 1.2.1

Julius Plenz — 2010-06-28T09:31:44

* Julius Plenz <plenz< at >cis.fu-berlin.de> [2010-06-28 11:10]:

Duh, mailman stripped the attachments. Here they are:

minimal example: http://userpage.fu-berlin.de/~plenz/bogofilter/minimal
patch: http://userpage.fu-berlin.de/~plenz/bogofilter/0001-bugfix-prevent-memory-corruption-in-base64_decode.patch a

Julius
_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

[patch] Fix possible memory corruption in bogofilter 1.2.1

Julius Plenz — 2010-06-28T09:08:26

Hi,

I found a bug in the base64_decode function which may cause memory
corruption when the function is executed on a malformed base64 encoded
string.

Please find attached a minimal example which makes "bogofilter -e -p"
crash and a patch (with inline problem description) that fixes the bug.

Cheers,
Julius
Content-Type: multipart/mixed;boundary="----bound"

------bound
Content-Transfer-Encoding: base64


=C7ET=DDNERSAVA=DE=20
------bound
Content-Type: text/plain; charset="iso-8859-9"
_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Re: Where can I find test Email Dataset

BlackKnight — 2009-08-22T19:25:02

Yeah, That will make sense~~

 will go back and check my email history

 Thanks!

Frank

2009/8/20 Thomas Anderson <tanderson< at >orderamidchaos.com>

_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Re: Where can I find test Email Dataset

Thomas Anderson — 2009-08-20T20:09:00

I've found that spammers are quite generous in providing free spam data 
sets ;-)

Tom

BlackKnight wrote:

_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Where can I find test Email Dataset

BlackKnight — 2009-08-20T15:05:54

Hi Everyone,

   I'd like to do some study on bogofilter and are wondering if there are
any good  free data set that I can use for training?

  Thanks in advance!



Frank
_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Re: Where can I find test Email Dataset

BlackKnight — 2009-08-22T19:25:02

Yeah, That will make sense~~

 will go back and check my email history

 Thanks!

Frank

2009/8/20 Thomas Anderson <tanderson< at >orderamidchaos.com>

_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Re: Where can I find test Email Dataset

Thomas Anderson — 2009-08-20T20:09:00

I've found that spammers are quite generous in providing free spam data 
sets ;-)

Tom

BlackKnight wrote:

_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev

Where can I find test Email Dataset

BlackKnight — 2009-08-20T15:05:54

Hi Everyone,

   I'd like to do some study on bogofilter and are wondering if there are
any good  free data set that I can use for training?

  Thanks in advance!



Frank
_______________________________________________
Bogofilter-dev mailing list
Bogofilter-dev< at >bogofilter.org
http://www.bogofilter.org/mailman/listinfo/bogofilter-dev