From: Guest section DW <dwguest@win.tue.nl>
To: Olaf Kirch <okir@caldera.de>, Michal Zalewski <lcamtuf@dione.ids.pl>
Cc: BUGTRAQ@securityfocus.com, linux-kernel@vger.kernel.org
Subject: Re: More modutils: It's probably worse.
Date: Tue, 14 Nov 2000 11:29:26 +0100 [thread overview]
Message-ID: <20001114112926.A1498@win.tue.nl> (raw)
In-Reply-To: <Pine.LNX.4.21.0011132040160.1699-100000@ferret.lmh.ox.ac.uk> <Pine.LNX.4.21.0011132352550.31869-100000@dione.ids.pl> <20001114095921.E30730@monad.caldera.de>
In-Reply-To: <20001114095921.E30730@monad.caldera.de>; from Olaf Kirch on Tue, Nov 14, 2000 at 09:59:22AM +0100
On Tue, Nov 14, 2000 at 09:59:22AM +0100, Olaf Kirch wrote:
> PS: The load_nls code tries to check for buffer overflows, but
> gets it wrong:
>
> struct nls_table *nls;
> char buf[40];
>
> if (strlen(charset) > sizeof(buf) - sizeof("nls_"))
> fail;
> sprintf(buf, "nls_%s", charset);
>
> This will accept charset names of up to 35 characters,
> because sizeof("nls_") is 5. This gives you a single NUL byte
> overflow. Whether it's dangerous or not depends on whether your
> compiler reserves stack space for the *nls pointer or not...
Where is the overflow? If charset has 35 characters then
sprintf(buf, "nls_%s", charset);
writes 40 bytes into buf, and that fits.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
next prev parent reply other threads:[~2000-11-14 10:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <Pine.LNX.4.21.0011132040160.1699-100000@ferret.lmh.ox.ac.uk>
[not found] ` <Pine.LNX.4.21.0011132352550.31869-100000@dione.ids.pl>
2000-11-14 8:59 ` More modutils: It's probably worse Olaf Kirch
2000-11-14 10:04 ` David Schleef
2000-11-14 10:29 ` Guest section DW [this message]
2000-11-14 10:38 ` Olaf Kirch
2000-11-14 19:20 ` Ben Ford
2000-11-14 20:24 ` Michael H. Warfield
2000-11-14 19:42 ` H. Peter Anvin
2000-11-14 23:27 ` Keith Owens
2000-11-15 10:43 ` Olaf Titz
2000-11-15 11:17 ` Tim Waugh
2000-11-16 4:31 ` Keith Owens
2000-11-17 0:48 ` Rusty Russell
2000-11-14 12:47 Petr Vandrovec
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20001114112926.A1498@win.tue.nl \
--to=dwguest@win.tue.nl \
--cc=BUGTRAQ@securityfocus.com \
--cc=lcamtuf@dione.ids.pl \
--cc=linux-kernel@vger.kernel.org \
--cc=okir@caldera.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox