Subj : docs/v322_new.md src/sbbs3/getmsg.cpp readmail.cpp readmsgs.cpp sbbs.h
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Wed Sep 30 2026 16:22:28

https://gitlab.synchro.net/main/sbbs/-/commit/3a602f2c3d109d110579ec35
Modified Files:
	docs/v322_new.md src/sbbs3/getmsg.cpp readmail.cpp readmsgs.cpp sbbs.h src/smblib/smbhash.c smblib.h
Log Message:
Verify the title before acting on a subject-CRC match in the readers (#1208)

The "search title forward/backward" commands (> and <) of the sub-board
and mail readers decided that two messages share a title by comparing the
16-bit subject CRC stored in the index, and jumped to the first CRC match
without ever reading its header. A CRC-16 collision therefore silently
landed the user on a message with an unrelated title, and the real next
match was skipped. The same omission gated a non-sub-op's view of deleted
posts on the raw from-name CRC.

Treat the index CRC as the candidate filter it is, the way the rest of
these files already use the name CRCs: on a CRC hit, read the header and
compare the actual strings.

- New smb_subject_match() in smblib compares two subjects with the same
  normalization smb_subject_crc() applies (leading "RE:" prefixes, letter
  case and trailing white-space ignored); the RE:-skipping is now shared
  by both functions
- New sbbs_t::msg_subject_matches() does the CRC pre-check, then loads the
  candidate header and compares subjects; all four title-search loops use
  it
- The deleted-post visibility check for non-sub-ops confirms the author by
  name after the CRC match, mirroring the private-post check below it

Reproduced on a scratch terminal server with three posts whose first and
second titles share a CRC-16 (only the third truly matches the first):
before, > from message 1 landed on message 2; after, it lands on message 3
and < returns to message 1, in both the sub-board and the mail reader.
smb_subject_match() unit-checked against RE:, case, white-space and NULL
inputs. The deleted-post change was not exercised.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
--- SBBSecho 3.38-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.