Re: Re: strings / libbfd crasher

[Michal Zalewski <lcamtuf () coredump cx>]

Well, there's also a trivial stack buffer overflow in srec.c near line 254:

      char buf[10];
...
        sprintf (buf, "\\%03o", (unsigned int) c);

But with this test case, c will be -44, or "\1777777777777777777724",
which sounds a lot longer than 9 characters.

http://lcamtuf.coredump.cx/strings-stack-overflow

/mz