Subject: Re: gzip buffer overflow found
To: Simon Burge <simonb@wasabisystems.com>
From: enami tsugutomo <enami@sm.sony.co.jp>
List: current-users
Date: 01/19/2001 14:57:46
Simon Burge <simonb@wasabisystems.com> writes:
> @@ -1028,7 +1033,7 @@ local int get_istat(iname, sbuf)
> #ifdef NO_MULTIPLE_DOTS
> dot = strrchr(ifname, '.');
> if (dot == NULL) {
> - strcat(ifname, ".");
> + strlcat(ifname, ".", sizeof(ifname));
> dot = strrchr(ifname, '.');
I guess following code assumes that `dot' isn't NULL. So, strictly
speaking it is better to detect overflow here.
> - if (*dot == '\0') strcpy(dot, ".");
> + if (*dot == '\0')
> + strlcpy(dot, ".", sizeof(dot));
> dot[MAX_EXT_CHARS+1-strlen(s)] = '\0'; <== THIS
It is suspectable whether this assignment is safe or not, especially
since user can specify suffix.
enami.