Bug#451886: fgets() and poison NULL byte attacks (aka NULL escapes)

2007-11-18 Thread Andrew Buckeridge
package: libc6 version: 2.3.6.ds1-13etch2 severity: wishlist Possible partial fix for fgets and alternatives. Bug #57729 is marked as done. It could be fixed for real. I have found null escapes a pretty reliable way of breaking many C programs including various editors. The standard C fgets fu

Bug#413195: Variable junk and segfault with gettimeofday function

2007-03-02 Thread Andrew Buckeridge
package: libc6 version: 2.3.6.ds1-11 I incorrectly posted Bug#413078 against kernel, but had similar prob with old kernel too. The bloated version works, but the simple one does not. Any ideas why? Man pages have: PRINTF(3) SYNOPSIS #include GETTIMEOFDAY(2) SYNOPSIS #include

Bug#609756: vsnprintf segfaults on second attempt with alloca

2011-01-12 Thread Andrew Buckeridge
larger than many auto arrays. Is stack allocation failing later? /* fprint.c - unistdio fprint function - Andrew Buckeridge */ #include #include #include #include #include "fprint.h" /* #include */ /* +Ve == bytes written -Ve == bytes required */ int vfnprint(int fdout, int r, const

Bug#609756: vsnprintf segfaults on second attempt with alloca

2011-01-12 Thread Andrew Buckeridge
Package: libc6 Version: 2.7-18lenny7 Changing to alloca malloc does not help. /* fprint.c - unistdio fprint function - Andrew Buckeridge */ #include #include #include #include #include "fprint.h" /* #include */ /* +Ve == bytes written -Ve == bytes required */ int vfnprint(int fd

Bug#609756: vsnprintf segfaults on second attempt with alloca

2011-01-12 Thread Andrew Buckeridge
)(&(last)+sizeof(last)) #define va_arg(ap, type) ((ap)+=sizeof(type),(type)*((ap)-sizeof(type))) would be wrong. On Wed, 12 Jan 2011 10:18:41 + Florian Weimer wrote: > * Andrew Buckeridge: > > > int vfprint(int fdout, const char *fmt, va_list ap) > > { > > int i=N