ie8 fix
madison

Reply to Message

Re: Code snippet
JeremyAllison 26th Nov 2007
The code snippet would be too large for the article I'm afraid.

Essentially the problem was reading into a fixed-size buffer which was correctly length checked and sanitized so no possibility of overrun. This buffer was then (via a very covoluted code path) being passed to a function that was outputing a network packet with a shorter fixed buffer size. The incoming data was assumed to be safe - of course it wasn't (we need a C "taint" flag really).

We don't allow strcpy in Samba, it's a banned function.

Jeremy.
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

ie8 fix