You are viewing a plain text version of this content. The canonical link for it is here.

Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/05/22 16:38:16 UTC

DO NOT REPLY [Bug 30586] Apache htdbm utility buffer overflows/format strings

https://issues.apache.org/bugzilla/show_bug.cgi?id=30586





--- Comment #1 from Dan Poirier <po...@pobox.com>  2009-05-22 07:38:14 PST ---
It looks like this is still a potential issue in trunk.

The patch is not quite right.  These lines:

   kb[copylen] = '\0';

   rec[copylen] = '\0';

could write past the end of buffers, as copylen can
be set to the full length of the buffer.  Either copylen
should be restricted to one less than the buffer size,
or maybe we should just allocate these buffers dynamically.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org