Vuln Dev
Re: glibc glob_filename() recurse call stack overflow (Re[2]: Bash Blues ) Feb 16 2003 09:16AM
Ali Saifullah Khan (saifullah gamebox net)
file : bash-VERSION/lib/glob/glob.c
char ** glob_filename(pathname)
char * pathname;
{
.
.
{
directory_len = (filename - pathname) + 1;
directory_name = (char *) alloca (directory_len + 1);

bcopy (pathname, directory_name, directory_len);
directory_name[directory_len] = '\0';
++filename;
}
.
.
As Vladimir pointed out, instead of copying a large source string of length
'directory_len' why not simply copy strlen(pathname) bytes to directory_name.
Would this produce a fix ?....I'm not an expert when it comes to C, but so far this is what i conclude.

Regards.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus