This could be exploitable if user_supplied_data is 50 or more bytes long.
In specific,
50 - 50 - 1 == -1
Since strncat's len parameter is size_t (which is unsigned), strncat is
willing to append _way_ to many bytes. IIRC, some fingerd's had this
problem (possibly some identd, *shrug*).
Similar things can be done to snprintf and so on. A wrapper around those
library calls could be used to check if its unsigned (and wouldn't
have that much drawback, because I can't think of anything that'd do a
>2G string operation normally), by using int as opposed to size_t.
I guess this comes to the class of integer over/under flows now :)
>
> Same problem; not safe anyway. (sizeof (dst) - strlen(dst) - 1, if anything)
>
Another thing to use is consistency, for example,
char dst[50];
strncpy(dst, user_supplied_data, sizeof(dst));
strncat(dst, sizeof(dst) - strlen(dst) -1, moreuserdata);
This could be exploitable if user_supplied_data is 50 or more bytes long.
In specific,
50 - 50 - 1 == -1
Since strncat's len parameter is size_t (which is unsigned), strncat is
willing to append _way_ to many bytes. IIRC, some fingerd's had this
problem (possibly some identd, *shrug*).
Similar things can be done to snprintf and so on. A wrapper around those
library calls could be used to check if its unsigned (and wouldn't
have that much drawback, because I can't think of anything that'd do a
>2G string operation normally), by using int as opposed to size_t.
I guess this comes to the class of integer over/under flows now :)
Sincerely,
Andrew Griffiths
[ reply ]