Patches item #1822943, was opened at 2007-10-30 19:27 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1822943...

Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: puredata Group: None Status: Open Resolution: None Priority: 9 Private: No Submitted By: IOhannes m zmölnig (zmoelnig) Assigned to: Miller Puckette (millerpuckette) Summary: hexloader code broken!

Initial Comment: the hexmunge code in s_loader.c exposes a security hole:

s_loader:127 reads: memmove(symname+6, symname, strlen(symname+1));

but really it should read: memmove(symname+6, symname, strlen(symname)+1);

the code tries to copy the \0 character, but fails to do so (because the strlen(+1) returns to few bytes to be copied), which results in garbage in the symname after the memmove.

since this bug is a real security hole, i give it a high priority

----------------------------------------------------------------------

You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1822943...