Bugtraq mailing list archives

at the risk of another flamefest..


From: hobbit () avian org (*Hobbit*)
Date: Mon, 15 Jul 1996 00:36:49 -0400


This one triggered my "old classic" filter.  Your patch has

-       char buf[256];
+       char *buf=alloca(strlen(name)+50);

and five lines later, the original code fragment

        for (cp = name; *cp; )
                n += *cp++;

Is this a family of mistakes that male programmers constantly make??  It's
doesn't matter how big your buffer is, it's how you USE it -- i.e. how you
limit what can be stuffed INTO it.  Essentially unbounded processing of this
sort over areas that may not necessarily be conveniently zero-filled or
pre-terminated for you is one reason we have so many of these BUGS...

Maintaining perspective,

_H*



Current thread: