Subject: Re: gzip buffer overflow found
To: Simon Burge <simonb@wasabisystems.com>
From: enami tsugutomo <enami@sm.sony.co.jp>
List: current-users
Date: 01/19/2001 14:57:46
Simon Burge <simonb@wasabisystems.com> writes:

> @@ -1028,7 +1033,7 @@ local int get_istat(iname, sbuf)
>  #ifdef NO_MULTIPLE_DOTS
>      dot = strrchr(ifname, '.');
>      if (dot == NULL) {
> -        strcat(ifname, ".");
> +        strlcat(ifname, ".", sizeof(ifname));
>          dot = strrchr(ifname, '.');

I guess following code assumes that `dot' isn't NULL.  So, strictly
speaking it is better to detect overflow here.

> -        if (*dot == '\0') strcpy(dot, ".");
> +        if (*dot == '\0')
> +	    strlcpy(dot, ".", sizeof(dot));
>          dot[MAX_EXT_CHARS+1-strlen(s)] = '\0';		<== THIS

It is suspectable whether this assignment is safe or not, especially
since user can specify suffix.

enami.