Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Ruediger Pluem
On 04/24/2009 10:10 PM, C. Michael Pilato wrote: [Please Cc: me in responses -- I think I still have APR commit privs, but I'm not active here and not subscribed to the mailing lists.] In the past couple of weeks, I've seen two different reports of what appears to be corruption in the

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Jeff Trawick
On Fri, Apr 24, 2009 at 4:10 PM, C. Michael Pilato cmpil...@collab.netwrote: [Please Cc: me in responses -- I think I still have APR commit privs, but I'm not active here and not subscribed to the mailing lists.] In the past couple of weeks, I've seen two different reports of what appears

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread Ruediger Pluem
On 04/24/2009 10:10 PM, C. Michael Pilato wrote: /* tack on null terminator to remaining string */ *(vd.vbuff.curpos) = '\0'; Uh-oh. Buffer overflow! Our CollabNet engineer is proposing a simple fix: defining 'buf' inside apr_brigade_vprintf() like so: char

Re: Buffer overflow in apr_brigade_vprintf() ?

2009-04-24 Thread C. Michael Pilato
C. Michael Pilato wrote: [Please Cc: me in responses -- I think I still have APR commit privs, but I'm not active here and not subscribed to the mailing lists.] In the past couple of weeks, I've seen two different reports of what appears to be corruption in the stream of data transmitted by