Bugtraq mailing list archives
Re: GNU Sharutils buffer overflow vulnerability.
From: Didier Arenzana <darenzana () yahoo fr>
Date: Wed, 7 Apr 2004 10:03:01 +0200 (CEST)
--- Shaun Colley <shaunige () yahoo co uk> a écrit :
Product: GNU Sharutils -
Hello, I've juste read your advisory, and I'd like to advise your patch is incomplete:
[...] case 'o': - strcpy (output_base_name, optarg); + strncpy (output_base_name, optarg, sizeof(output_base_name));
You must add output_base_name[sizeof(output_base_name)]='\0' ; here, otherwize your string will not be null-termminated when optarg is too long. Regards, Didier. Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout ! Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/ Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
Current thread:
- GNU Sharutils buffer overflow vulnerability. Shaun Colley (Apr 06)
- Re: GNU Sharutils buffer overflow vulnerability. Didier Arenzana (Apr 07)
- Re: GNU Sharutils buffer overflow vulnerability. Carlos Eduardo Pinheiro (Apr 07)
- Re: GNU Sharutils buffer overflow vulnerability. Dan Yefimov (Apr 10)
- Re: GNU Sharutils buffer overflow vulnerability. Didier Arenzana (Apr 07)