[lkml]   [2000]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
On Tue, Nov 14, 2000 at 09:59:22AM +0100, Olaf Kirch wrote:

> PS: The load_nls code tries to check for buffer overflows, but
> gets it wrong:
> struct nls_table *nls;
> char buf[40];
> if (strlen(charset) > sizeof(buf) - sizeof("nls_"))
> fail;
> sprintf(buf, "nls_%s", charset);
> This will accept charset names of up to 35 characters,
> because sizeof("nls_") is 5. This gives you a single NUL byte
> overflow. Whether it's dangerous or not depends on whether your
> compiler reserves stack space for the *nls pointer or not...

Where is the overflow? If charset has 35 characters then
sprintf(buf, "nls_%s", charset);
writes 40 bytes into buf, and that fits.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:45    [W:0.087 / U:4.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site