5 ms·

No, the code overwrote the 9th byte of the buffer to add a null terminator: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050

No, the code overwrote the 9th byte of the buffer to add a null terminator: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 https://github.com/sudo-project/sudo/commit/bd209b9f16fcd127... So it's not just reading past the end of the buffer, but it's overwriting a single byte potentially belonging to another object. It may still cause a crash but it's relatively unlikely that it could cause something more severe.

Someone 4y ago
I don’t understand how this can be correct: if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) { strlcpy(des_pass, pass, sizeof(des_pass)); pass = des_pass; } Doesn’t that truncate your password if it happens to have DESLEN characters?
_kbh_ 4y ago
> No, the code overwrote the 9th byte of the buffer to add a null terminator: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd127 https://github.com/sudo-project/sudo/commit/bd209b9f16fcd127... Ah that makes a lot more sense. > So it's not just reading past the end of the buffer, but it's overwriting a single byte potentially belonging to another object. It may still cause a crash but it's relatively unlikely that it could cause something more severe. Yeah I agree that nothing severe should come from it. The allocations are probably larger then the size of the buffer being used so it may not even right off the end of its own allocation.