INN BUFFEROVERFLOWS!

[zybadawg333 at hushmail.com]

On Tue, 16 Jan 2007 23:21:22 +0100 Russ Allbery <rra at stanford.edu> 
wrote:
>zybadawg333 at hushmail.com writes:
>
>> innd/cc.c:1810:    i = RECVorREAD(CCchan->fd, buff, bufflen) ;
>> lib/inndcomm.c:337:    i = RECVorREAD(ICCfd, buff, bufsiz);
>> lib/inndcomm.c:374:    i = RECVorREAD(ICCfd, buff, rlen);
>
>Why do you think those are buffer overflows?

bufflen/bufsiz/rlen can be larger than sizeof(buff).

-- z



Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485