Patches item #1822943, was opened at 2007-10-30 11:27 Message generated for change (Comment added) made by nobody You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1822943...

Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: puredata Group: bugfix Status: Open Resolution: None Priority: 9 Private: No Submitted By: IOhannes m zmölnig (zmoelnig) Assigned to: Miller Puckette (millerpuckette) Summary: hexloader code security issue

Initial Comment: the hexmunge code in s_loader.c exposes a security hole:

s_loader:127 reads: memmove(symname+6, symname, strlen(symname+1));

but really it should read: memmove(symname+6, symname, strlen(symname)+1);

the code tries to copy the \0 character, but fails to do so (because the strlen(+1) returns to few bytes to be copied), which results in garbage in the symname after the memmove.

since this bug is a real security hole, i give it a high priority

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody) Date: 2007-10-30 11:52

Message: Logged In: NO

if this is a real security hole, then how would anyone exploit it?

----------------------------------------------------------------------

You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1822943...