Patches item #1848295, was opened at 2007-12-10 16:53 Message generated for change (Comment added) made by sf-robot You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1848295...
Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: puredata Group: bugfix
Status: Closed
Resolution: None Priority: 5 Private: No Submitted By: Russell Bryant (russellbryant) Assigned to: Miller Puckette (millerpuckette) Summary: Fix small potential stack overflow
Initial Comment: Attached is a patch to fix another potential stack buffer overflow in s_main.c. I didn't send this over in private because I don't think it can be exploited in any useful way, so it's just a small bug.
----------------------------------------------------------------------
Comment By: SourceForge Robot (sf-robot)
Date: 2008-01-30 19:20
Message: Logged In: YES user_id=1312539 Originator: NO
This Tracker item was closed automatically by the system. It was previously set to a Pending status, and the original submitter did not respond within 14 days (the time period specified by the administrator of this Tracker).
----------------------------------------------------------------------
Comment By: Miller Puckette (millerpuckette) Date: 2008-01-14 10:45
Message: Logged In: YES user_id=313747 Originator: NO
taken.
----------------------------------------------------------------------
Comment By: Hans-Christoph Steiner (eighthave) Date: 2007-12-26 13:45
Message: Logged In: YES user_id=27104 Originator: NO
checked into branch-v0-40-extended
----------------------------------------------------------------------
Comment By: Russell Bryant (russellbryant) Date: 2007-12-10 18:41
Message: Logged In: YES user_id=1942915 Originator: YES
Also, let me just clarify my original summary just a little bit.
You can cause the overrun of the buffer by providing a really long input string to the -schedlib command line option. It's just not exploitable in such a way that it would be considered a security issue.
----------------------------------------------------------------------
Comment By: Russell Bryant (russellbryant) Date: 2007-12-10 18:38
Message: Logged In: YES user_id=1942915 Originator: YES
I'm sorry for the stupid typo. That code is actually only compiled in for a Windows build (whenever MSW is defined), so I didn't notice.
----------------------------------------------------------------------
Comment By: Russell Bryant (russellbryant) Date: 2007-12-10 18:36
Message: Logged In: YES user_id=1942915 Originator: YES
File Added: filename_overflow.patch2.txt
----------------------------------------------------------------------
Comment By: Hans-Christoph Steiner (eighthave) Date: 2007-12-10 17:18
Message: Logged In: YES user_id=27104 Originator: NO
I am guessing there is a typo in that patch, since the new line also uses sprintf() instead of snprintf():
- sprintf(filename, "%s.dll", sys_externalschedlibname); + sprintf(filename, sizeof(filename), "%s.dll", sys_externalschedlibname);
----------------------------------------------------------------------
You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1848295...
-
SourceForge.net