Re: ftpd: the advisory version

[teo () DIGIRO NET (Teodor Cimpoesu)]

Hi Dan!
> > void
> > func_proper (unsigned char *domain)
> > {
> >     int             len = domain[0];
> >     unsigned char   buff[64];
> >
> >
> >     if (len >= 64)
> >             return;
> >
> >     strncpy (buff, &domain[1], len);
> >     buff[63] = '\x00';
> > }
>
> Uh, no, the strncpy() prototype is:
>
>     char *strncpy(char *dst, const char *src, size_t n);
>
> len should be a size_t (which is typedef'd to be some kind of unsigned int),
> which would avoid the problem (without having to mess with explicitly
> unsigned chars, which will cause warnings on platforms where chars are
> signed, for one thing).

suppose domain[0] == '\x80', then if domain is `signed char' then
len is -128, and if it's casted to unsigned int when calling
strncpy can be 2^(sizeof(int)*8-1)-1, so there you go :)

-- teodor