Re: QPOPPER problem.... ONE crude patch...

From: Miquel van Smoorenburg (miquelsat_private)
Date: Sat Jun 27 1998 - 15:18:22 PDT

  • Next message: Theo de Raadt: "Re: patch for qpopper remote exploit bug"

    In article <Pine.LNX.3.96.980627181545.1549A-100000at_private>,
    Daniel Ryde <rydeat_private> wrote:
    >On Sat, 27 Jun 1998, Tom Brown wrote:
    >
    >>         vsnprintf(mp,sizeof(message)-(mp - message)-3,format,ap);
    >
    >Dangerous, if the string is truncated it will skip the null termination,
    >then later the strcat might fail miserably (unless all arcitectures makes
    >for sure that, when allocated, the string is filled with null, which I
    >really doubt).
    
    Unlike strncat, snprintf is supposed to add a trailing zero. If it
    doesn't then your library implementation is wrong and you probably have
    more things to worry about ..
    
    >Another note is the next lines of sprintf (architectures
    >that dont have vsprintf) that will have the same problem as vsprintf.
    >Change these to snprintf in a similar way, and add a null to the end.
    
    I'll post a revised patch in a minute. For architectures without
    vnsprintf() it just makes the buffer 4 times bigger, that's sufficient
    (that's not a guess but a fact).
    
    Mike.
    --
     Miquel van Smoorenburg | Our vision is to speed up time,
        miquelsat_private  |   eventually eliminating it.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:00:06 PDT