Re: stackguard-like embedded protection

[Slawek <sgp () TELSATGP COM PL>]

Wednesday, September 06, 2000 8:35 PM +0200, Crispin Cowan wrote:
> > The attached post by Mike Frantzen of Purdue (cc'd) to Bugtraq is an
excellent
> This, of course, would work much better if I actually attached Mike's post
:-)


The code you've attached can bypass NULL if it follows %

ie.
"it's a test string %\0something that will be analised when it souldn't - it
can contain additional % .."


It cannot be exploited in any way other than allowing *more* parameters to
printf then %'s .. or segfaulting :)

altho' when you try to code something to secure the program you probably
should avoid this ;)


Bye,
Slawek


PS. forward it to Mike Frantzen if you wish