From: Sven Schnelle <svens@gmx.de>
To: linux-kernel@vger.kernel.org
Subject: ip_conntrack_standalone / sprintf to buffer
Date: Mon, 23 May 2005 22:50:54 -0700 [thread overview]
Message-ID: <873bscuj3s.fsf@deprecated.intranet.astaro.de> (raw)
[-- Attachment #1: Type: text/plain, Size: 866 bytes --]
Hi,
found the following code snippet in ip_conntrack_standalone.c:145
in function conntrack_iterate():
-------------------000000------8<-----------------------------
newlen = print_conntrack(buffer + *len, hash->ctrack);
printk("len + newlen: %d maxlen: %d\n", *len + newlen, maxlen);
if (*len + newlen > maxlen)
return 1;
else *len += newlen;
-------------000000------------8<-----------------------------
print_conntrack() uses sprintf without length checking. And now i'm
wondering what happens if for example, maxlen=3072 and
len=3071. print_conntrack uses sprintf, writes beyond the end the buffer, and
after this the check (*len + newlen > maxlen) is done. Looks to me like
a bug.
Did i missed something?
Bye,
Sven.
--
"If you can't make it good, at least make it look good." Bill Gates on
the solid code base of Win9X
[-- Attachment #2: Type: application/pgp-signature, Size: 188 bytes --]
next reply other threads:[~2005-05-25 2:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-05-24 5:50 Sven Schnelle [this message]
-- strict thread matches above, loose matches on Subject: below --
2005-05-24 5:50 ip_conntrack_standalone / sprintf to buffer Sven Schnelle
2005-06-11 15:57 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=873bscuj3s.fsf@deprecated.intranet.astaro.de \
--to=svens@gmx.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.