On Mon, 2011-06-13 at 10:56 -0400, Bowie Bailey wrote:
> On 6/10/2011 8:01 PM, Karsten Bräckelmann wrote:
> > IFF you use the sought channel with SA 3.3.x, you will need the reorder
> > hack to bend the alphabet.
>
> Would it be worthwhile to change the main code instead? Rather than
> making a change to ensure that the sought channel is processed after
> updates, why not ensure that the main updates file is always processed
> first regardless of the naming of any other third party rules? You
> could either make it a special case in the code that processes the .cf
> files, or you could change the filename to 0_updates_spamassassin_org.cf.
>
> This would not only fix the current issue with the sought rules, it
> would also avoid future problems like this.
Thought about a "stock always comes first" code change myself, but this
won't help immediately. It will not get into the upcoming 3.3.2 release,
and moreover is very unlikely to make it into any version before 3.4.0.
The problem remains for 3.3.x -- until one of the next stock rules
updates, which will have the Sought FRAUD patterns dropped.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
