4 ms·
Not a "C guy", but I simply read it as: Strings could be missing a "\0" and therefore some function could read too far later on..
by gizzlon 15y ago
Not a "C guy", but I simply read it as:
Strings could be missing a "\0" and therefore some function could read too far later on..
- matthavener 15y agoNot exactly. Some function expecting a c-string could actually read too short. What happens is some attacker sends a message using a channel/format that specifies a length and a buffer. But, the buffer contains a "\0". For example, (10, "wtf\0extra") is passed as a 10 char string. But, some c function might only see it as (3,"wtf"). The (usually) simply solution is to fail validation when a string of N bytes contains a NULL char before the N+1 byte.