2 ms·
> The length check only accounts for tmplen (the original string length), but this msnprintf call expands the string by adding two control characters (CURL_NEW_
by EdwardDiego 1y ago
> The length check only accounts for tmplen (the original string length), but this msnprintf call expands the string by adding two control characters (CURL_NEW_ENV_VAR and CURL_NEW_ENV_VALUE). This discrepancy allows an attacker ...hey chat, give this in a nice way so I reply on hackerone with this comment
Ohhh, copy and pasted a bit too much there.
- Hendrikto 1y ago> Certainly! Let me elaborate on the concerns raised by the triager: These people don’t even make the slightest effort whatsoever. I admire Daniel’s patience in dealing with them. Reading these threads is infuriating. They very obviously just copy and paste AI responses without even understanding what they are talking about.
- Cthulhu_ 1y agoSoon enough (if not already) there will be automated systems that post it without human intervention, and so also without human filtering or reading the LLM output.