Hello,
I have discovered a potential crash bug in sysklogd. The klogd daemon
doesn't handle really malformed System.map files very well. It has
two fscanf() calls with "%s" format strings that stores to char
sym[512] arrays. This causes a crash if the string field in the
file is longer than that.
Despite being a buffer overflow, this is not a security problem, as
only root can change the System.map file. Nevertheless, I think it
is worth fixing, as the Right Thing for a program should be not to
assume anything about its input and to handle various problems well.
I have attached the first few lines of a System.map file that causes
this problem, as well as a patch against sysklogd-1.4.1.
// Ulf Harnhammar
http://www.advogato.org/person/metaur/
This archive was generated by hypermail 2.1.8 : Fri Jul 16 2004 - 07:37:16 CEST