Bug#319489: Buffer overflow in Description parsing

2005-07-23 Thread Kevin Dwyer
On Sat, Jul 23, 2005 at 01:56:00PM -0400, Anthony DeRobertis wrote: > Kevin Dwyer wrote: > > > - while (*scratch != '\n') { > > + while (*scratch != '\n' && idx < sizeof Description) { > > I strongly suspect that should be sizeof(Description)-1 because you're > going to NULL-terminate...

Bug#319489: Buffer overflow in Description parsing

2005-07-23 Thread Anthony DeRobertis
Kevin Dwyer wrote: > - while (*scratch != '\n') { > + while (*scratch != '\n' && idx < sizeof Description) { I strongly suspect that should be sizeof(Description)-1 because you're going to NULL-terminate... (didn't go back and look at the code to check closely) -- To UNSUBSCRIBE, email

Bug#319489: Buffer overflow in Description parsing

2005-07-23 Thread Kevin Dwyer
On Fri, Jul 22, 2005 at 10:28:10AM -0400, Anthony DeRobertis wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > In helpers.cpp, we find this code, which parses data returned from ebay: > >/* > * Parse the description out of the buffer first. This is > * most easily done a

Bug#319489: Buffer overflow in Description parsing

2005-07-22 Thread Anthony DeRobertis
Package: bidwatcher Version: 1.3.17-1 Severity: grave Tags: security -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 In helpers.cpp, we find this code, which parses data returned from ebay: /* * Parse the description out of the buffer first. This is * most easily done at the buffer-leve