lkml.org 
[lkml]   [2000]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
On Tue, Nov 14, 2000 at 09:59:22AM +0100, Olaf Kirch wrote:

> PS: The load_nls code tries to check for buffer overflows, but
> gets it wrong:
>
> struct nls_table *nls;
> char buf[40];
>
> if (strlen(charset) > sizeof(buf) - sizeof("nls_"))
> fail;
> sprintf(buf, "nls_%s", charset);
>
> This will accept charset names of up to 35 characters,
> because sizeof("nls_") is 5. This gives you a single NUL byte
> overflow. Whether it's dangerous or not depends on whether your
> compiler reserves stack space for the *nls pointer or not...

Where is the overflow? If charset has 35 characters then
sprintf(buf, "nls_%s", charset);
writes 40 bytes into buf, and that fits.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:45    [W:0.046 / U:3.452 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site