>Number:         2900
>Category:       bin
>Synopsis:       mail(1) dumps core if ~v is used
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 28 13:50:01 1996
>Last-Modified:
>Originator:     Onno van der Linden
>Organization:
	
>Release:        1.2B
>Environment:
	
System: NetBSD sheep 1.2B NetBSD 1.2B (SHEEP) #11: Sun Oct 27 19:57:37 MET 1996 onno@sheep:/usr/src/sys/arch/i386/compile/SHEEP i386


>Description:
	mail dumps core if the ~v escape is used
	
>How-To-Repeat:
        1. mail root
        2. ~v
	
>Fix:
        run_command() in popen.c has a sigset_t *mask as second parameter.
        You'll only see: run_command(cmd, 0, .....) or
        run_command(shell, 0, ....).
        When mask is used in a call to sigismember, sigismember references
        a NULL pointer resulting in a core dump.
        One of the possible fixes is:

        sigset_t nset;
        sigemptyset(&nset);
        run_command(cmd, &nset, ....)

        for each of the 5 times run_command is called.
>Audit-Trail:
>Unformatted: