I ran into a similar bug in my own code. I traced it to StrNCopy. It places
a null byte at n+1 (!!!) if the source string is N bytes long (ie, the
source string is longger than N). This is where N is the last parameter.

Whereas it SHOULD put the null at N, not N+1.

I bet that NegLibGetHostName does something like:
        StrNCopy(dest, hostName, sizeof(dest));

And then dest[sizeof(dest)+1] happens to be the spot getting zapped.

Brian

>Craig Fields (now part of Scrawl!) found this bug.  I'm submitting it on
>his (and Scrawl's) behalf.  A source fix for the bug and a workaround
>are also provided.
>
>Sanjay
>Scrawl, LLC
>
>- ---------------
>
>Subject: Palm DNS library bug description
>
>When using NetLibGetHostByName to look up a hostname which returns
>more than three IP addresses ("americaonline.aol.com" for example),
>the "addressList" array of NetHostInfoBufType is overrun, and the NULL
>termination of that array falls into the "address" array. Thus the
>first IP address returned becomes 0.0.0.0. "addressList" should have
>been declared to be length netDNSMaxAddresses+1, as aliasList was.
>
>The workaround I am using is to test NetHostInfoPtr->addrListP[0] == 0
>and skip it if so.

_____________________________________________________________________
Mark/Space Softworks                               voice 408-293-7299
111 West Saint John, 3rd Floor                       fax 408-293-7298
San Jose, CA 95113                         <http://www.markspace.com>

    Mac OS, PalmOS, Windows, Web and Newton Software & Solutions:
        PageNOW!, PageME!, PhoneWatcher, Online, Communicate,
            ZMODEM, Telnet, PC-ANSI, Videotex CTB Tools

Reply via email to