Re: Administrivia: List Announcement

[Valdis.Kletnieks () vt edu]

On Tue, 13 May 2003 15:11:05 EDT, Bernie Cosell <bernie () fantasyfarm com>  said:

> that's clearly off by one and so the loop will run at least one char past 
> the end of buf1, clobbering one byte beyond the end of the chunk of space 
> that got malloc'ed for buf1.
>
> What harm that causes is hard to evaluate, though, isn't it?  Doesn't it 
> depend a lot on how a particular C compiler lays things out and how the 
> libraries (in particular, malloc) work and what else the program has been 
> doing?

Amazingly enough, the hole in XNTPD a while back was just this - a one byte
overflow.  It was possible to leverage that into a complete remote exploit.

Attachment: _bin
Description: