bugGNU nano - Bugs: bug #43877, buffer overrun

 
 

bug #43877: buffer overrun

Submitted by:  Joshua Rogers <megamansec3>
Submitted on:  Wed 24 Dec 2014 12:42:35 AM UTC  
 
Severity: 3 - NormalStatus: Fixed
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 15 Feb 2015 04:43:35 PM UTC, comment #1:

This was sufficiently addressed by a patch by Kamil Dudka, applied in revision 5109, right?

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Wed 24 Dec 2014 12:42:35 AM UTC, original submission:

Hi,

In files.c, a buffer overrun may occur during the lockfile phase:

char lockprog[12], lockuser[16];
[...]
strncpy(lockuser, &lockbuf[28], 16);

", 16" does not allow for a NUL byte.

It is then printed multiple times afterwards, allowing for the leak.

Thanks,

Joshua Rogers <megamansec3>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Posted a comment)
  • -unavailable- added by megamansec3 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 20 Mar 2015 11:47:59 AM UTCbensStatusNeed Info=>Fixed
      Open/ClosedOpen=>Closed
    Sun 15 Feb 2015 04:43:35 PM UTCbensStatusNone=>Need Info
      Assigned toNone=>bens

    Back to the top


    Powered by Savane 3.1-cleanup1