Delete obsolete /* ARGSUSED */ lint comments.

ok miod@ millert@

For open/openat, if the flags parameter does not contain O_CREAT, the
3rd (variadic) mode_t parameter is irrelevant. Many developers in the past
have passed mode_t (0, 044, 0644, or such), which might lead future people
to copy this broken idiom, and perhaps even believe this parameter has some
meaning or implication or application. Delete them all.
This comes out of a conversation where tb@ noticed that a strange (but
intentional) pledge behaviour is to always knock-out high-bits from
mode_t on a number of system calls as a safety factor, and his bewilderment
that this appeared to be happening against valid modes (at least visually),
but no sorry, they are all irrelevant junk. They could all be 0xdeafbeef.
ok millert

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Replace the local getname() and getuserid() functions with calls
to user_from_uid(3) and uid_from_user(3). This requires sprinkling
const in a few places to match the return value of user_from_uid(3).
OK tb@

Modernize allocation by:

* removing unneeded casts of void* return values
* replacing varied and creative error messages with the allocation
function's name
* replacing errx() with err() so that the errno string is reported

ok beck@, jung@, millert@

Prefer mkostemp(O_CLOEXEC) over mkstemp()+fcntl(F_SETFD)
Prefer fopen("re") over fopen("r")+fcntl(F_SETFD)

ok otto@ millert@

Use errc/warnc to simplify code.
Also, in 'ftp', always put the error message last, after the hostname/ipaddr.

ok jsing@ krw@ millert@

ctype and other sign extension fixes.

with deraadt and millert, ok millert

use FD_CLOEXEC instead of 1; from David Hill

ok otto

Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'
for chars.

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

delint; millert ok

Get rid of the ancient "clobber" command. It was really only for debugging
purposes. Noticed and OK by deraadt@

dont compare int to NULL, millert@ ok

better realloc. ok deraadt jose

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

o kill strcpy()
o check return values of malloc and friends
o use strdup() when sensible

o ANSIfy
o Style nits
o Use const to silent stupid -Wall warnings
o strnc{py,at} -> strlc{py,at}
o Use strpbrk() instead of homegrown anyof()
o Use NULL instead of #defines with 0 cast to a pointer
This still could use a proper audit

Major signal overhaul. We no longer longjmp all over the place.
Instead, routines responsible to gathering user input (or in some
cases outputting data) catch the signals and set flags as needed.
Because of this some handlers are install without the SA_RESTART
flag so syscalls are not restarted and we can check the flag. All
signal handlers are now safe.

This should make the flow of control a bit more grokable but the
code is still ugly.

properly bail out of incfile(); millert ok

Remove evil #ifdef __GNUC__ garbage to avoid longjmp clobbering and
use volatile instead.

Changes from Don Beusee:
o escape From line with a leading '>' when needed
o only print To: address and Subject lines if actually present
o new variable 'allnet' to treat user@foo and user@bar as the same "user"
o folders command now takes an optional argument like ls.
o new "pipe" (|) command to pipe the message through an arbitrary command
o make header display format the same as SunOS 4.1.3 /usr/ucb/mail
o tilde commands work regardless of interactive mode.
o fix "read: Interrupted system call" error by retrying if EINTR
o expanded help file
Changes by me:
o read the help file via the PAGER as it is now more than 24 lines long

printf with % for the prompt

warnx?/errx? paranoia (use "%s" not a bare string unless it is a
constant). These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

branches: 1.19.2;
When incorporating new messages, clear the "new" count before the
inc so the count of new messages is useful afterwards. This makes
mail behave more like the SunOS version in this respect.

Fix comments in .mailrc where there is no space after the hash (#). Noted by pjanzen@foatdi.harvard.edu

back out some signal changes that can cause mail to hang when quitting due to SIGCHLD blockage

Never remove a mail spool, as we may not have proper prics, just truncate. Also block signals in a few critical areas

NetBSD changes (mostly comsmetic):
replace panic() with calls to err()/errx()
use S_IS* instead of doing by hand with S_IF*.
Use TIMESPEC_TO_TIMEVAL() and gettimeofday instead of time(2)
Use _POSIX_VDISABLE, not 0
Kill register

Make istrcpy() take a size (not length) field, now called istrncpy().
Change some strcpy() -> strncpy() out of paranoia.

Fix one possible oflow (not exploitable) and do a wee bit of KNF.
Much more remains to be done.

tempnam(3) goes bye bye.

Replace 3 tempnam()'s with mkstemp. The two left look tricky.

incfile() needs to lock the mail spool so it doesn't get partial messages.
Noticed by Theo.

Release signals when we get an error condition in incfile().

NOSTR -> NULL
Use sigsetjmp/siglongjmp instead of sigjmp/longjmp for portability.

bcopy() -> memcpy() and fix some casts.

Merge in NetBSD and 4.4BSD-lite2 changes as well as some of my own.
- handle long lines safely (from NetBSD)
- use puts/fputs and putchar/putc when it makes sense
- use err/errx and warn/warnx when it makes sense
- make return() and sizeof() style consisten
- some more buffer safety

overflows abound

r?index -> strr?chr

from christos;
- Fix PR/105: Implement dot locking protocol and check return value of flock.
- Fix PR/2247: Don't call unknown users "ubluit". Issue an error message.
- Fix/add prototypes.
- Fix warnings.
- Use POSIX signal mask calls.

From NetBSD: merge of 960317

branches: 1.1.1;
Initial revision

For open/openat, if the flags parameter does not contain O_CREAT, the
3rd (variadic) mode_t parameter is irrelevant. Many developers in the past
have passed mode_t (0, 044, 0644, or such), which might lead future people
to copy this broken idiom, and perhaps even believe this parameter has some
meaning or implication or application. Delete them all.
This comes out of a conversation where tb@ noticed that a strange (but
intentional) pledge behaviour is to always knock-out high-bits from
mode_t on a number of system calls as a safety factor, and his bewilderment
that this appeared to be happening against valid modes (at least visually),
but no sorry, they are all irrelevant junk. They could all be 0xdeafbeef.
ok millert

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Replace the local getname() and getuserid() functions with calls
to user_from_uid(3) and uid_from_user(3). This requires sprinkling
const in a few places to match the return value of user_from_uid(3).
OK tb@

Modernize allocation by:

* removing unneeded casts of void* return values
* replacing varied and creative error messages with the allocation
function's name
* replacing errx() with err() so that the errno string is reported

ok beck@, jung@, millert@

Prefer mkostemp(O_CLOEXEC) over mkstemp()+fcntl(F_SETFD)
Prefer fopen("re") over fopen("r")+fcntl(F_SETFD)

ok otto@ millert@

Use errc/warnc to simplify code.
Also, in 'ftp', always put the error message last, after the hostname/ipaddr.

ok jsing@ krw@ millert@

ctype and other sign extension fixes.

with deraadt and millert, ok millert

use FD_CLOEXEC instead of 1; from David Hill

ok otto

Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'
for chars.

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

delint; millert ok

Get rid of the ancient "clobber" command. It was really only for debugging
purposes. Noticed and OK by deraadt@

dont compare int to NULL, millert@ ok

better realloc. ok deraadt jose

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

o kill strcpy()
o check return values of malloc and friends
o use strdup() when sensible

o ANSIfy
o Style nits
o Use const to silent stupid -Wall warnings
o strnc{py,at} -> strlc{py,at}
o Use strpbrk() instead of homegrown anyof()
o Use NULL instead of #defines with 0 cast to a pointer
This still could use a proper audit

Major signal overhaul. We no longer longjmp all over the place.
Instead, routines responsible to gathering user input (or in some
cases outputting data) catch the signals and set flags as needed.
Because of this some handlers are install without the SA_RESTART
flag so syscalls are not restarted and we can check the flag. All
signal handlers are now safe.

This should make the flow of control a bit more grokable but the
code is still ugly.

properly bail out of incfile(); millert ok

Remove evil #ifdef __GNUC__ garbage to avoid longjmp clobbering and
use volatile instead.

Changes from Don Beusee:
o escape From line with a leading '>' when needed
o only print To: address and Subject lines if actually present
o new variable 'allnet' to treat user@foo and user@bar as the same "user"
o folders command now takes an optional argument like ls.
o new "pipe" (|) command to pipe the message through an arbitrary command
o make header display format the same as SunOS 4.1.3 /usr/ucb/mail
o tilde commands work regardless of interactive mode.
o fix "read: Interrupted system call" error by retrying if EINTR
o expanded help file
Changes by me:
o read the help file via the PAGER as it is now more than 24 lines long

printf with % for the prompt

warnx?/errx? paranoia (use "%s" not a bare string unless it is a
constant). These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

branches: 1.19.2;
When incorporating new messages, clear the "new" count before the
inc so the count of new messages is useful afterwards. This makes
mail behave more like the SunOS version in this respect.

Fix comments in .mailrc where there is no space after the hash (#). Noted by pjanzen@foatdi.harvard.edu

back out some signal changes that can cause mail to hang when quitting due to SIGCHLD blockage

Never remove a mail spool, as we may not have proper prics, just truncate. Also block signals in a few critical areas

NetBSD changes (mostly comsmetic):
replace panic() with calls to err()/errx()
use S_IS* instead of doing by hand with S_IF*.
Use TIMESPEC_TO_TIMEVAL() and gettimeofday instead of time(2)
Use _POSIX_VDISABLE, not 0
Kill register

Make istrcpy() take a size (not length) field, now called istrncpy().
Change some strcpy() -> strncpy() out of paranoia.

Fix one possible oflow (not exploitable) and do a wee bit of KNF.
Much more remains to be done.

tempnam(3) goes bye bye.

Replace 3 tempnam()'s with mkstemp. The two left look tricky.

incfile() needs to lock the mail spool so it doesn't get partial messages.
Noticed by Theo.

Release signals when we get an error condition in incfile().

NOSTR -> NULL
Use sigsetjmp/siglongjmp instead of sigjmp/longjmp for portability.

bcopy() -> memcpy() and fix some casts.

Merge in NetBSD and 4.4BSD-lite2 changes as well as some of my own.
- handle long lines safely (from NetBSD)
- use puts/fputs and putchar/putc when it makes sense
- use err/errx and warn/warnx when it makes sense
- make return() and sizeof() style consisten
- some more buffer safety

overflows abound

r?index -> strr?chr

from christos;
- Fix PR/105: Implement dot locking protocol and check return value of flock.
- Fix PR/2247: Don't call unknown users "ubluit". Issue an error message.
- Fix/add prototypes.
- Fix warnings.
- Use POSIX signal mask calls.

From NetBSD: merge of 960317

branches: 1.1.1;
Initial revision

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Replace the local getname() and getuserid() functions with calls
to user_from_uid(3) and uid_from_user(3). This requires sprinkling
const in a few places to match the return value of user_from_uid(3).
OK tb@

Modernize allocation by:

* removing unneeded casts of void* return values
* replacing varied and creative error messages with the allocation
function's name
* replacing errx() with err() so that the errno string is reported

ok beck@, jung@, millert@

Prefer mkostemp(O_CLOEXEC) over mkstemp()+fcntl(F_SETFD)
Prefer fopen("re") over fopen("r")+fcntl(F_SETFD)

ok otto@ millert@

Use errc/warnc to simplify code.
Also, in 'ftp', always put the error message last, after the hostname/ipaddr.

ok jsing@ krw@ millert@

ctype and other sign extension fixes.

with deraadt and millert, ok millert

use FD_CLOEXEC instead of 1; from David Hill

ok otto

Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'
for chars.

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

delint; millert ok

Get rid of the ancient "clobber" command. It was really only for debugging
purposes. Noticed and OK by deraadt@

dont compare int to NULL, millert@ ok

better realloc. ok deraadt jose

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

o kill strcpy()
o check return values of malloc and friends
o use strdup() when sensible

o ANSIfy
o Style nits
o Use const to silent stupid -Wall warnings
o strnc{py,at} -> strlc{py,at}
o Use strpbrk() instead of homegrown anyof()
o Use NULL instead of #defines with 0 cast to a pointer
This still could use a proper audit

Major signal overhaul. We no longer longjmp all over the place.
Instead, routines responsible to gathering user input (or in some
cases outputting data) catch the signals and set flags as needed.
Because of this some handlers are install without the SA_RESTART
flag so syscalls are not restarted and we can check the flag. All
signal handlers are now safe.

This should make the flow of control a bit more grokable but the
code is still ugly.

properly bail out of incfile(); millert ok

Remove evil #ifdef __GNUC__ garbage to avoid longjmp clobbering and
use volatile instead.

Changes from Don Beusee:
o escape From line with a leading '>' when needed
o only print To: address and Subject lines if actually present
o new variable 'allnet' to treat user@foo and user@bar as the same "user"
o folders command now takes an optional argument like ls.
o new "pipe" (|) command to pipe the message through an arbitrary command
o make header display format the same as SunOS 4.1.3 /usr/ucb/mail
o tilde commands work regardless of interactive mode.
o fix "read: Interrupted system call" error by retrying if EINTR
o expanded help file
Changes by me:
o read the help file via the PAGER as it is now more than 24 lines long

printf with % for the prompt

warnx?/errx? paranoia (use "%s" not a bare string unless it is a
constant). These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

branches: 1.19.2;
When incorporating new messages, clear the "new" count before the
inc so the count of new messages is useful afterwards. This makes
mail behave more like the SunOS version in this respect.

Fix comments in .mailrc where there is no space after the hash (#). Noted by pjanzen@foatdi.harvard.edu

back out some signal changes that can cause mail to hang when quitting due to SIGCHLD blockage

Never remove a mail spool, as we may not have proper prics, just truncate. Also block signals in a few critical areas

NetBSD changes (mostly comsmetic):
replace panic() with calls to err()/errx()
use S_IS* instead of doing by hand with S_IF*.
Use TIMESPEC_TO_TIMEVAL() and gettimeofday instead of time(2)
Use _POSIX_VDISABLE, not 0
Kill register

Make istrcpy() take a size (not length) field, now called istrncpy().
Change some strcpy() -> strncpy() out of paranoia.

Fix one possible oflow (not exploitable) and do a wee bit of KNF.
Much more remains to be done.

tempnam(3) goes bye bye.

Replace 3 tempnam()'s with mkstemp. The two left look tricky.

incfile() needs to lock the mail spool so it doesn't get partial messages.
Noticed by Theo.

Release signals when we get an error condition in incfile().

NOSTR -> NULL
Use sigsetjmp/siglongjmp instead of sigjmp/longjmp for portability.

bcopy() -> memcpy() and fix some casts.

Merge in NetBSD and 4.4BSD-lite2 changes as well as some of my own.
- handle long lines safely (from NetBSD)
- use puts/fputs and putchar/putc when it makes sense
- use err/errx and warn/warnx when it makes sense
- make return() and sizeof() style consisten
- some more buffer safety

overflows abound

r?index -> strr?chr

from christos;
- Fix PR/105: Implement dot locking protocol and check return value of flock.
- Fix PR/2247: Don't call unknown users "ubluit". Issue an error message.
- Fix/add prototypes.
- Fix warnings.
- Use POSIX signal mask calls.

From NetBSD: merge of 960317

branches: 1.1.1;
Initial revision

Replace the local getname() and getuserid() functions with calls
to user_from_uid(3) and uid_from_user(3). This requires sprinkling
const in a few places to match the return value of user_from_uid(3).
OK tb@

Modernize allocation by:

* removing unneeded casts of void* return values
* replacing varied and creative error messages with the allocation
function's name
* replacing errx() with err() so that the errno string is reported

ok beck@, jung@, millert@

Prefer mkostemp(O_CLOEXEC) over mkstemp()+fcntl(F_SETFD)
Prefer fopen("re") over fopen("r")+fcntl(F_SETFD)

ok otto@ millert@

Use errc/warnc to simplify code.
Also, in 'ftp', always put the error message last, after the hostname/ipaddr.

ok jsing@ krw@ millert@

ctype and other sign extension fixes.

with deraadt and millert, ok millert

use FD_CLOEXEC instead of 1; from David Hill

ok otto

Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'
for chars.

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

delint; millert ok

Get rid of the ancient "clobber" command. It was really only for debugging
purposes. Noticed and OK by deraadt@

dont compare int to NULL, millert@ ok

better realloc. ok deraadt jose

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

o kill strcpy()
o check return values of malloc and friends
o use strdup() when sensible

o ANSIfy
o Style nits
o Use const to silent stupid -Wall warnings
o strnc{py,at} -> strlc{py,at}
o Use strpbrk() instead of homegrown anyof()
o Use NULL instead of #defines with 0 cast to a pointer
This still could use a proper audit

Major signal overhaul. We no longer longjmp all over the place.
Instead, routines responsible to gathering user input (or in some
cases outputting data) catch the signals and set flags as needed.
Because of this some handlers are install without the SA_RESTART
flag so syscalls are not restarted and we can check the flag. All
signal handlers are now safe.

This should make the flow of control a bit more grokable but the
code is still ugly.

properly bail out of incfile(); millert ok

Remove evil #ifdef __GNUC__ garbage to avoid longjmp clobbering and
use volatile instead.

Changes from Don Beusee:
o escape From line with a leading '>' when needed
o only print To: address and Subject lines if actually present
o new variable 'allnet' to treat user@foo and user@bar as the same "user"
o folders command now takes an optional argument like ls.
o new "pipe" (|) command to pipe the message through an arbitrary command
o make header display format the same as SunOS 4.1.3 /usr/ucb/mail
o tilde commands work regardless of interactive mode.
o fix "read: Interrupted system call" error by retrying if EINTR
o expanded help file
Changes by me:
o read the help file via the PAGER as it is now more than 24 lines long

printf with % for the prompt

warnx?/errx? paranoia (use "%s" not a bare string unless it is a
constant). These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

branches: 1.19.2;
When incorporating new messages, clear the "new" count before the
inc so the count of new messages is useful afterwards. This makes
mail behave more like the SunOS version in this respect.

Fix comments in .mailrc where there is no space after the hash (#). Noted by pjanzen@foatdi.harvard.edu

back out some signal changes that can cause mail to hang when quitting due to SIGCHLD blockage

Never remove a mail spool, as we may not have proper prics, just truncate. Also block signals in a few critical areas

NetBSD changes (mostly comsmetic):
replace panic() with calls to err()/errx()
use S_IS* instead of doing by hand with S_IF*.
Use TIMESPEC_TO_TIMEVAL() and gettimeofday instead of time(2)
Use _POSIX_VDISABLE, not 0
Kill register

Make istrcpy() take a size (not length) field, now called istrncpy().
Change some strcpy() -> strncpy() out of paranoia.

Fix one possible oflow (not exploitable) and do a wee bit of KNF.
Much more remains to be done.

tempnam(3) goes bye bye.

Replace 3 tempnam()'s with mkstemp. The two left look tricky.

incfile() needs to lock the mail spool so it doesn't get partial messages.
Noticed by Theo.

Release signals when we get an error condition in incfile().

NOSTR -> NULL
Use sigsetjmp/siglongjmp instead of sigjmp/longjmp for portability.

bcopy() -> memcpy() and fix some casts.

Merge in NetBSD and 4.4BSD-lite2 changes as well as some of my own.
- handle long lines safely (from NetBSD)
- use puts/fputs and putchar/putc when it makes sense
- use err/errx and warn/warnx when it makes sense
- make return() and sizeof() style consisten
- some more buffer safety

overflows abound

r?index -> strr?chr

from christos;
- Fix PR/105: Implement dot locking protocol and check return value of flock.
- Fix PR/2247: Don't call unknown users "ubluit". Issue an error message.
- Fix/add prototypes.
- Fix warnings.
- Use POSIX signal mask calls.

From NetBSD: merge of 960317

branches: 1.1.1;
Initial revision

Modernize allocation by:

* removing unneeded casts of void* return values
* replacing varied and creative error messages with the allocation
function's name
* replacing errx() with err() so that the errno string is reported

ok beck@, jung@, millert@

Prefer mkostemp(O_CLOEXEC) over mkstemp()+fcntl(F_SETFD)
Prefer fopen("re") over fopen("r")+fcntl(F_SETFD)

ok otto@ millert@

Use errc/warnc to simplify code.
Also, in 'ftp', always put the error message last, after the hostname/ipaddr.

ok jsing@ krw@ millert@

ctype and other sign extension fixes.

with deraadt and millert, ok millert

use FD_CLOEXEC instead of 1; from David Hill

ok otto

Avoid using NULL in non-pointer contexts: use 0 for integer values and '\0'
for chars.

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

delint; millert ok

Get rid of the ancient "clobber" command. It was really only for debugging
purposes. Noticed and OK by deraadt@

dont compare int to NULL, millert@ ok

better realloc. ok deraadt jose

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

o kill strcpy()
o check return values of malloc and friends
o use strdup() when sensible

o ANSIfy
o Style nits
o Use const to silent stupid -Wall warnings
o strnc{py,at} -> strlc{py,at}
o Use strpbrk() instead of homegrown anyof()
o Use NULL instead of #defines with 0 cast to a pointer
This still could use a proper audit

Major signal overhaul. We no longer longjmp all over the place.
Instead, routines responsible to gathering user input (or in some
cases outputting data) catch the signals and set flags as needed.
Because of this some handlers are install without the SA_RESTART
flag so syscalls are not restarted and we can check the flag. All
signal handlers are now safe.

This should make the flow of control a bit more grokable but the
code is still ugly.

properly bail out of incfile(); millert ok

Remove evil #ifdef __GNUC__ garbage to avoid longjmp clobbering and
use volatile instead.

Changes from Don Beusee:
o escape From line with a leading '>' when needed
o only print To: address and Subject lines if actually present
o new variable 'allnet' to treat user@foo and user@bar as the same "user"
o folders command now takes an optional argument like ls.
o new "pipe" (|) command to pipe the message through an arbitrary command
o make header display format the same as SunOS 4.1.3 /usr/ucb/mail
o tilde commands work regardless of interactive mode.
o fix "read: Interrupted system call" error by retrying if EINTR
o expanded help file
Changes by me:
o read the help file via the PAGER as it is now more than 24 lines long

printf with % for the prompt

warnx?/errx? paranoia (use "%s" not a bare string unless it is a
constant). These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

branches: 1.19.2;
When incorporating new messages, clear the "new" count before the
inc so the count of new messages is useful afterwards. This makes
mail behave more like the SunOS version in this respect.

Fix comments in .mailrc where there is no space after the hash (#). Noted by pjanzen@foatdi.harvard.edu

back out some signal changes that can cause mail to hang when quitting due to SIGCHLD blockage

Never remove a mail spool, as we may not have proper prics, just truncate. Also block signals in a few critical areas

NetBSD changes (mostly comsmetic):
replace panic() with calls to err()/errx()
use S_IS* instead of doing by hand with S_IF*.
Use TIMESPEC_TO_TIMEVAL() and gettimeofday instead of time(2)
Use _POSIX_VDISABLE, not 0
Kill register

Make istrcpy() take a size (not length) field, now called istrncpy().
Change some strcpy() -> strncpy() out of paranoia.

Fix one possible oflow (not exploitable) and do a wee bit of KNF.
Much more remains to be done.

tempnam(3) goes bye bye.

Replace 3 tempnam()'s with mkstemp. The two left look tricky.

incfile() needs to lock the mail spool so it doesn't get partial messages.
Noticed by Theo.

Release signals when we get an error condition in incfile().

NOSTR -> NULL
Use sigsetjmp/siglongjmp instead of sigjmp/longjmp for portability.

bcopy() -> memcpy() and fix some casts.

Merge in NetBSD and 4.4BSD-lite2 changes as well as some of my own.
- handle long lines safely (from NetBSD)
- use puts/fputs and putchar/putc when it makes sense
- use err/errx and warn/warnx when it makes sense
- make return() and sizeof() style consisten
- some more buffer safety

overflows abound

r?index -> strr?chr

from christos;
- Fix PR/105: Implement dot locking protocol and check return value of flock.
- Fix PR/2247: Don't call unknown users "ubluit". Issue an error message.
- Fix/add prototypes.
- Fix warnings.
- Use POSIX signal mask calls.

From NetBSD: merge of 960317

branches: 1.1.1;
Initial revision