patchDcHub: Hub software for Direct Connect - Patches: patch #2737, SECURITY: Buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #2737: SECURITY: Buffer overflow in db_str_set and others

Submitter:  None
Submitted:  Thu 04 Mar 2004 10:25:51 PM UTC
   
 
Category:  None Priority:  9 - Immediate
Status:  None Privacy:  Public
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Open

Thu 04 Mar 2004 10:25:51 PM UTC, original submission:  

This is a good old fashioned single-null overflow.

Exploitability would be tricky and reserved for those who can use -dbset or any other command which flows data through the charset conversion functions in the XML db part, but is theoretically possible.

There is a simple off-by-one null overflow in the macros defined in src/xmltools.h - an equally simple and apparently effective patch follows. I note that the use of static buffers here is inconsistent with the careful nature of the rest of the project, and recommend that this patch be applied as an immediate interim fix, with transitioning to dynamic buffers later (halfway there already).

A simple examination of the origin, and usage, of outlen in the macros in xmltools.h should enlighten you as to the origin of this bug.

--- src/xmltools.h.orig 2004-03-04 22:11:43.000000000 +0000
+++ src/xmltools.h      2004-03-04 22:00:48.000000000 +0000
@@ -30 +30 @@
-#define DEFINE_BUF_CONV(var)   char var[MAX_BUF_CONV_LEN]
+#define DEFINE_BUF_CONV(var)   char var[MAX_BUF_CONV_LEN+1]

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

No changes have been made to this item

Back to the top

Powered by Savane 3.13-d3ae.
Corresponding source code