Re: GNU Sharutils buffer overflow vulnerability.

["Carlos Eduardo Pinheiro" <cbc99@xxxxxxxxxx>]

btw.. you´re still overwriting 1 byte after the bounds of output_base_name,
output_base_name[sizeof(output_base_name)-1] = '\0'; will be sane...

----- Original Message ----- 
From: "Didier Arenzana" <darenzana@xxxxxxxx>
To: "Shaun Colley" <shaunige@xxxxxxxxxxx>; <bugtraq@xxxxxxxxxxxxxxxxx>
Sent: Wednesday, April 07, 2004 5:03 AM
Subject: Re: GNU Sharutils buffer overflow vulnerability.


> --- Shaun Colley <shaunige@xxxxxxxxxxx> a écrit :
> > Product:      GNU Sharutils -
>
>   Hello,
>   I've juste read your advisory, and I'd like to advise your patch is
> incomplete:
>
> > [...]
> >        case 'o':
> > -       strcpy (output_base_name, optarg);
> > +       strncpy (output_base_name, optarg,
> > sizeof(output_base_name));
>
> You must add
>
>      output_base_name[sizeof(output_base_name)]='\0' ;
>
> here, otherwize your string will not be null-termminated when optarg is
too
> long.
>
> Regards,
> Didier.
>
>
>
>
>
>
>
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !
> Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
>
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez
Yahoo! Messenger sur http://fr.messenger.yahoo.com
>