| Anonymous | Login | Signup for a new account | 11-10-2008 12:31 PST |
| Main | My View | View Issues | Change Log | Docs |
| Viewing Issue Simple Details [ Jump to Notes ] | [ View Advanced ] [ Issue History ] [ Print ] | ||||||||
| ID | Category | Severity | Reproducibility | Date Submitted | Last Update | ||||
| 0004184 | [BusyBox] Other | minor | always | 07-16-08 17:32 | 08-19-08 17:56 | ||||
| Reporter | cristic | View Status | public | ||||||
| Assigned To | BusyBox | ||||||||
| Priority | normal | Resolution | fixed | ||||||
| Status | closed | Product Version | svn | ||||||
| Summary | 0004184: printf buffer overflow | ||||||||
| Description |
Hi, "printf %" leads to a buffer overflow, and prints random values from the stack: This should be rejected as in Coreutils: $ printf % ./printf: %: invalid conversion specification The problem is that printf does not validate the format specifier. One possible fix would be to add a check along these lines this after line 201 in printf.c: direc_start = f++; + if (*f == '\0') + fprintf(stderr, "invalid conversion specification"); direc_length = 1; field_width = precision = -1; if (*f == '%') { bb_putchar('%'); break; } Thanks, Cristian |
||||||||
| Additional Information | |||||||||
| Attached Files |
|
||||||||
|
|
|||||||||
| Copyright © 2000 - 2006 Mantis Group |