[34443] in bugtraq
Re: GNU Sharutils buffer overflow vulnerability.
daemon@ATHENA.MIT.EDU (Carlos Eduardo Pinheiro)
Wed Apr 7 17:59:25 2004
Message-ID: <017801c41ce2$e8b32e20$2a1766c8@lenin>
From: "Carlos Eduardo Pinheiro" <cbc99@bol.com.br>
To: "Didier Arenzana" <darenzana@yahoo.fr>,
"Shaun Colley" <shaunige@yahoo.co.uk>, <bugtraq@securityfocus.com>
Date: Wed, 7 Apr 2004 17:57:14 -0300
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
btw.. you´re still overwriting 1 byte after the bounds of output_base_name,
output_base_name[sizeof(output_base_name)-1] = '\0'; will be sane...
----- Original Message -----
From: "Didier Arenzana" <darenzana@yahoo.fr>
To: "Shaun Colley" <shaunige@yahoo.co.uk>; <bugtraq@securityfocus.com>
Sent: Wednesday, April 07, 2004 5:03 AM
Subject: Re: GNU Sharutils buffer overflow vulnerability.
> --- Shaun Colley <shaunige@yahoo.co.uk> a écrit :
> > Product: GNU Sharutils -
>
> Hello,
> I've juste read your advisory, and I'd like to advise your patch is
> incomplete:
>
> > [...]
> > case 'o':
> > - strcpy (output_base_name, optarg);
> > + strncpy (output_base_name, optarg,
> > sizeof(output_base_name));
>
> You must add
>
> output_base_name[sizeof(output_base_name)]='\0' ;
>
> here, otherwize your string will not be null-termminated when optarg is
too
> long.
>
> Regards,
> Didier.
>
>
>
>
>
>
>
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !
> Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
>
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez
Yahoo! Messenger sur http://fr.messenger.yahoo.com
>
