On Wed, Nov 22, 2006 at 03:01:00PM -0500, Ian Kilgore wrote:
> while (j < len - 2) {
I know, I know, I'm replying to myself. I'm sorry. Here is a cookie.
To clarify, len is size_t. When len is <2, this becomes:
while (j < big number depending on platform) {
At the start of base64(), a buffer is allocated. When len is one, that
buffer is
(len + 2) / 3 * 4 + 1 = 5 bytes big. "big number depending on platform"
is more than five :)
Then stuff like this happens inside the loop:
buf[i++] = base64_table[bin[j] >> 2];
'i' does not get smaller, and gets incremented a few times in the body
of the loop, so after a bit, base64() starts to write outside of buf.
So this is a buffer overflow, but I'm not sure if it can be exploited.
Even if it could be exploited, would it really get you anywhere? :)
--
Ian Kilgore
echo "[EMAIL PROTECTED]" | tr pzfwxt ikagno
signature.asc
Description: Digital signature
-- TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug TriLUG Organizational FAQ : http://trilug.org/faq/ TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
