Bug 138110 - python overflows stack buffer
Summary: python overflows stack buffer
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: python
Version: 4.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Brian Stein
QA Contact: Brock Organ
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-11-04 18:03 UTC by Brian Stein
Modified: 2013-03-01 05:14 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2004-11-11 16:51:53 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Arjan van de Ven 2004-11-04 18:03:47 UTC
Description of problem:

Modules/socketmodule.c contains:

#ifdef ENABLE_IPV6
        char ip[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN) + 1];
#else
        char ip[INET_ADDRSTRLEN + 1];
#endif
...
        /* Guarantee NUL-termination for PyString_FromString() below */
        memset((void *) &ip[0], '\0', sizeof(ip) + 1);

which overwrites the ip[] buffer by 1 byte.

Comment 1 Mihai Ibanescu 2004-11-04 18:31:04 UTC
Reported upstream as bug 105470

Comment 2 Mihai Ibanescu 2004-11-09 19:18:12 UTC
Fixed in python-2.3.4-13

Comment 3 Jay Turner 2004-11-11 16:51:53 UTC
Fix confirmed with 2.3.4-13.


Note You need to log in before you can comment on or make changes to this bug.