Lynx 2.8 overflow

• Previous message: X-Force: "ISS Security Advisory: LDAP Buffer overflow against Microsoft"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Sorry if this is a well-known bug

This was tested with Lynx Version 2.8.1pre.9.
An IMG tag with a width of about 250 chars instantly crashes
this version (and probably others). This bug is not
limited to lynx, it was first discovered with MSIE 4/5.

As far as I know, the overflow is due to a limited and
non-checked buffer in function strrchr() ...

Here is some sample code:
<img width=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001>
FAILED<br><br>

Mixter

----------------------
members.xoom.com/i0wnu

• Next message: kasper: "erps"
• Previous message: X-Force: "ISS Security Advisory: LDAP Buffer overflow against Microsoft"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:39:08 PDT