overflowable buffer in eternity

Doomworld Forums : Powered by vBulletin version 2.2.5

Doomworld Forums > Special Interest > Eternity > overflowable buffer in eternity

Author

All times are GMT. The time now is 04:06.

Anders
No one knows I'm schepe

Posts: 427
Registered: 03-02

found this in c_io.c C_Printf.

unsigned char tempstr[10240];
...
vsprintf(tempstr, s, args);

this could cause an overflow, but this is easily fixed by using
vsnprintf(tempstr, 10240, s, args) instead.

__________________
++++++++++[>++++++++++>++++++++++++>+++++++++++>++
+>+<<<<<-]>.>-.>>++.<<<++.>>+.+++.<--.>-----.+++++
+.>.<<<-----.>>-.<<++++.>>>.<<<++.------.>++++.>>>.

01-04-03 03:01 #

Profile || Blog || PM || Homepage || Search || Add Buddy

IP || Edit/Delete || Quote

fraggle
Filled with the code of Doom

Posts: 6607
Registered: 07-00

My fault :P

And dont you mean

vsnprintf(tempstr, 10239, s, args)

01-04-03 03:29 #

Profile || Blog || PM || Email || Homepage || Search || Add Buddy

IP || Edit/Delete || Quote

Anders
No one knows I'm schepe

Posts: 427
Registered: 03-02

no, it will take the size of the buffer, it will leave room for the zero automagicaly.

__________________
++++++++++[>++++++++++>++++++++++++>+++++++++++>++
+>+<<<<<-]>.>-.>>++.<<<++.>>+.+++.<--.>-----.+++++
+.>.<<<-----.>>-.<<++++.>>>.<<<++.------.>++++.>>>.

Last edited by Anders on 01-05-03 at 04:34

01-05-03 04:07 #

Profile || Blog || PM || Homepage || Search || Add Buddy

IP || Edit/Delete || Quote

Anders
No one knows I'm schepe

Posts: 427
Registered: 03-02

oh, and the retards at ms, who like to complicate things call it _vsnprintf instead.

__________________
++++++++++[>++++++++++>++++++++++++>+++++++++++>++
+>+<<<<<-]>.>-.>>++.<<<++.>>+.+++.<--.>-----.+++++
+.>.<<<-----.>>-.<<++++.>>>.<<<++.------.>++++.>>>.

Last edited by Anders on 01-05-03 at 04:34

01-05-03 04:16 #

Profile || Blog || PM || Homepage || Search || Add Buddy

IP || Edit/Delete || Quote