Bug 138110 - python overflows stack buffer
python overflows stack buffer
Status: CLOSED RAWHIDE
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: python (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Brian Stein
Brock Organ
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-11-04 13:03 EST by Brian Stein
Modified: 2013-03-01 00:14 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-11-11 11:51:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Arjan van de Ven 2004-11-04 13:03:47 EST
Description of problem:

Modules/socketmodule.c contains:

#ifdef ENABLE_IPV6
        char ip[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN) + 1];
#else
        char ip[INET_ADDRSTRLEN + 1];
#endif
...
        /* Guarantee NUL-termination for PyString_FromString() below */
        memset((void *) &ip[0], '\0', sizeof(ip) + 1);

which overwrites the ip[] buffer by 1 byte.
Comment 1 Mihai Ibanescu 2004-11-04 13:31:04 EST
Reported upstream as bug 105470
Comment 2 Mihai Ibanescu 2004-11-09 14:18:12 EST
Fixed in python-2.3.4-13
Comment 3 Jay Turner 2004-11-11 11:51:53 EST
Fix confirmed with 2.3.4-13.

Note You need to log in before you can comment on or make changes to this bug.