From e7373c72821f60495e5d850d4a0c054819ca3ef9 Mon Sep 17 00:00:00 2001
From: brainx <12695242+brainx@users.noreply.github.com>
Date: Wed, 17 Jun 2026 20:24:20 +0200
Subject: [PATCH] Fix SMTP rejection check, dropped news posts, and
 format-string defects

- mail.c: `!line->data[0] == '2'` parsed as `(!line->data[0]) == '2'`
  (always false), so a non-2xx reply to SMTP MAIL FROM was never treated
  as an error. Use `line->data[0] != '2'` so relay rejections are caught.
- menusend.c: non-anonymous local news posting opened a pipe to NEWS but
  never wrote the message or closed it, silently dropping the post and
  leaking the descriptor. Write the message and close the pipe.
- menustats.c / rem.c: pass non-literal strings through "%s" to avoid
  format-string interpretation (config-controlled ALLPINGERSURL, mbox
  From-line), fixing -Wformat-security warnings.
---
 Src/mail.c      | 2 +-
 Src/menusend.c  | 7 ++++++-
 Src/menustats.c | 2 +-
 Src/rem.c       | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/Src/mail.c b/Src/mail.c
index 2d0eff8..e115dc9 100644
--- a/Src/mail.c
+++ b/Src/mail.c
@@ -569,7 +569,7 @@ int smtp_send(SOCKET relay, BUFFER *head, BUFFER *message, char *from)
   buf_setf(line, "MAIL FROM:<%b>\r\n", content);
   sock_cat(relay, line);
   sock_getsmtp(relay, line);
-  if (!line->data[0] == '2') {
+  if (line->data[0] != '2') {
     errlog(ERRORMSG, "SMTP relay does not accept mail: %b\n", line);
     goto end;
   }
diff --git a/Src/menusend.c b/Src/menusend.c
index 8281764..d1e7e36 100644
--- a/Src/menusend.c
+++ b/Src/menusend.c
@@ -432,8 +432,13 @@ void send_message(int type, char *nym, BUFFER *in)
 	    if (type == 'p' || type == 'f') {
 	      if (strchr(NEWS, '@')) {
 		/*  NOT_IMPLEMENTED; */
-	      } else
+	      } else {
 		f = openpipe(NEWS);
+		if (f != NULL) {
+		  buf_write(msg, f);
+		  closepipe(f);
+		}
+	      }
 	    } else {
 	      if (NAME[0]) {
 		buf_sets(tmp, NAME);
diff --git a/Src/menustats.c b/Src/menustats.c
index 6437847..81f9ad1 100644
--- a/Src/menustats.c
+++ b/Src/menustats.c
@@ -290,7 +290,7 @@ static int download_list() {
 
   clear();
   standout();
-  printw(ALLPINGERSURL);
+  printw("%s", ALLPINGERSURL);
   standend();
 
   mvprintw(3,0,"downloading %s...", ALLPINGERSURL);
diff --git a/Src/rem.c b/Src/rem.c
index a2b4675..62fdd47 100644
--- a/Src/rem.c
+++ b/Src/rem.c
@@ -191,7 +191,7 @@ void logmail(char *mailbox, BUFFER *message)
       t = time(NULL);
       tc = localtime(&t);
       strftime(line, LINELEN, "From Mixmaster %a %b %d %H:%M:%S %Y\n", tc);
-      fprintf(mbox, line);
+      fprintf(mbox, "%s", line);
     }
     buf_write(message, mbox);
     fprintf(mbox, "\n\n");