[Bug libc/4439] New: inet_ntop can write past end of dst buffer

[Bug libc/4439] New: inet_ntop can write past end of dst buffer

[phelps at mantara dot com]

When inet_ntop (from libc/resolv/inet_ntop.c revision 1.9) is provided with an
AF_INET family address and a buffer that is one byte shorter than is needed to
hold the resulting string, it happily writes the terminating NUL byte past the
end of the buffer.

-- 
           Summary: inet_ntop can write past end of dst buffer
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: minor
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: phelps at mantara dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=4439

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/4439] inet_ntop can write past end of dst buffer

[phelps at mantara dot com]

------- Additional Comments From phelps at mantara dot com  2007-04-30 16:52 -------
Created an attachment (id=1743)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=1743&action=view)
Simple program to demonstrate the bug.

inet_ntop is told that the buffer is 9 bytes long, yet it writes a '\0' to
buffer[9].

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=4439

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/4439] inet_ntop can write past end of dst buffer

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2007-04-30 23:33 -------
Fixed in cvs.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=4439

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/4439] inet_ntop can write past end of dst buffer

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2007-07-12 15:14 -------
Subject: Bug 4439

CVSROOT:	/cvs/glibc
Module name:	libc
Branch: 	glibc-2_5-branch
Changes by:	jakub@sourceware.org	2007-07-12 15:14:24

Modified files:
	.              : ChangeLog 
	resolv         : Makefile inet_ntop.c 
Added files:
	resolv         : tst-inet_ntop.c 

Log message:
	2007-04-30  Jakub Jelinek  <jakub@redhat.com>
	
	[BZ #4439]
	* resolv/inet_ntop.c (inet_ntop4): Take terminating '\0' into
	account in the size check.
	* resolv/tst-inet_ntop.c: New test.
	* resolv/Makefile (tests): Add tst-inet_ntop.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/libc/ChangeLog.diff?cvsroot=glibc&only_with_tag=glibc-2_5-branch&r1=1.10362.2.77&r2=1.10362.2.78
http://sourceware.org/cgi-bin/cvsweb.cgi/libc/resolv/tst-inet_ntop.c.diff?cvsroot=glibc&only_with_tag=glibc-2_5-branch&r1=NONE&r2=1.1.6.1
http://sourceware.org/cgi-bin/cvsweb.cgi/libc/resolv/Makefile.diff?cvsroot=glibc&only_with_tag=glibc-2_5-branch&r1=1.48&r2=1.48.8.1
http://sourceware.org/cgi-bin/cvsweb.cgi/libc/resolv/inet_ntop.c.diff?cvsroot=glibc&only_with_tag=glibc-2_5-branch&r1=1.9&r2=1.9.8.1



-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=4439

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.