Vulnerability Development mailing list archives

Re: vi buffer overflow


From: Piyush Agarwal <pvagarwal () yahoo com>
Date: Fri, 9 Nov 2001 08:24:44 -0800 (PST)

Test results on SunOS 5.6:

# vi `perl -e 'print "A" x 9000'`
File name too long
[Hit enter to return]

# du `perl -e 'print "A" x 9000'`
File name too long

both commands dont result in to a seg fault.

-PA

--- Kaneda Akira <k_aneda () yahoo com> wrote:
Did some testing of my own.

on Redhat 7.0 (VIM 5.7.8)
# vi `perl -e 'print "A" x 9000'`
Vim: Caught deadly signal SEGV
Vim: Finished.
Segmentation fault (core dumped)
# uname -a
Linux riven 2.2.16-22 #1 Tue Aug 22 16:49:06 EDT
2000 i686 unknown
#

however du on redhat 7 was okay (du version 4.0x)

Also tested my slackware 7 system, vi and du didnt
crash (vi/elvis 2.1_4, du 4.0)
[Slackware system: Linux myst 2.2.16 #121 Fri Jun 16
20:43:40 PDT 2000
i486 unknown]

--- KF <dotslash () snosoft com> wrote:
Not sure how big of a deal either of these are due
to the fact that they
are not suid... any thoughts?

# vi `perl -e 'print "A" x 9000'`
Memory fault - core dumped

# du `perl -e 'print "A" x 9000'`
Memory fault - core dumped


# uname -a
SCO_SV scosysv 3.2 5.0.6 i386

-KF

---
Kaneda Akira
ICQ#49107701
Email: k_aneda () yahoo com
Mobile: 0418 445 821 (Australia only)
--
That's why we spend so much time trying to
understand our own
motivations and those of others.  That's what makes
life so
interesting.
    -- Kaji, Evangelion Ep 18
--
The only secure computer is one that's unplugged,
locked in a safe,
and buried 20 feet under the ground in a secret
location... and i'm
not even too sure about that one"--Dennis Huges,
FBI.





__________________________________________________
Do You Yahoo!?
Find a job, post your resume.
http://careers.yahoo.com


Current thread: