Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread C. Michael Pilato
C. Michael Pilato wrote: > [Please Cc: me in responses -- I think I still have APR commit privs, but > I'm not active here and not subscribed to the mailing lists.] > > In the past couple of weeks, I've seen two different reports of what appears > to be corruption in the stream of data transmitte

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Ruediger Pluem
On 04/24/2009 10:10 PM, C. Michael Pilato wrote: > > /* tack on null terminator to remaining string */ > *(vd.vbuff.curpos) = '\0'; > > Uh-oh. Buffer overflow! > > Our CollabNet engineer is proposing a simple fix: defining 'buf' inside > apr_brigade_vprintf() like so: > > char

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Jeff Trawick
On Fri, Apr 24, 2009 at 4:10 PM, C. Michael Pilato wrote: > [Please Cc: me in responses -- I think I still have APR commit privs, but > I'm not active here and not subscribed to the mailing lists.] > > In the past couple of weeks, I've seen two different reports of what > appears > to be corrupti

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Ruediger Pluem
On 04/24/2009 10:10 PM, C. Michael Pilato wrote: > [Please Cc: me in responses -- I think I still have APR commit privs, but > I'm not active here and not subscribed to the mailing lists.] > > In the past couple of weeks, I've seen two different reports of what appears > to be corruption in the

Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread C. Michael Pilato
[Please Cc: me in responses -- I think I still have APR commit privs, but I'm not active here and not subscribed to the mailing lists.] In the past couple of weeks, I've seen two different reports of what appears to be corruption in the stream of data transmitted by Subversion's mod_dav_svn throu