gmane.comp.misc.xvendor

zlib gzprintf() patch

Hi,

Just thought I'd share the tiny patch that went into Owl.  Attached.

The lack of configure checking for vsnprintf() is intentional (I want
this to not compile without a vsnprintf() anyway).

The Owl change log entry is:

2003/02/25	Package: zlib
Corrected a potential buffer overflow in gzprintf(), thanks to Bugtraq
postings by Crazy Einstein, Richard Kettlewell, and Carlo Marcelo
Arenas Belon.

--

-- 
/sd

diff -ur zlib-1.1.4.orig/gzio.c zlib-1.1.4/gzio.c
--- zlib-1.1.4.orig/gzio.c	Mon Mar 11 16:16:01 2002
+++ zlib-1.1.4/gzio.c	Tue Feb 25 07:08:36 2003
@@ -529,14 +529,9 @@
     int len;

     va_start(va, format);
-#ifdef HAS_vsnprintf
-    (void)vsnprintf(buf, sizeof(buf), format, va);
-#else
-    (void)vsprintf(buf, format, va);
-#endif

(Continue reading)

headers

Mark Hatle | 25 Feb 17:41

Re: zlib gzprintf() patch

Is this due to an audit?  Or did you find a problem/crash w/ errant data?

--Mark

Solar Designer wrote:
> Hi,
> 
> Just thought I'd share the tiny patch that went into Owl.  Attached.
> 
> The lack of configure checking for vsnprintf() is intentional (I want
> this to not compile without a vsnprintf() anyway).
> 
> The Owl change log entry is:
> 
> 2003/02/25	Package: zlib
> Corrected a potential buffer overflow in gzprintf(), thanks to Bugtraq
> postings by Crazy Einstein, Richard Kettlewell, and Carlo Marcelo
> Arenas Belon.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> diff -ur zlib-1.1.4.orig/gzio.c zlib-1.1.4/gzio.c
> --- zlib-1.1.4.orig/gzio.c	Mon Mar 11 16:16:01 2002
> +++ zlib-1.1.4/gzio.c	Tue Feb 25 07:08:36 2003
> @@ -529,14 +529,9 @@
>      int len;
>  
>      va_start(va, format);

(Continue reading)

headers

Mark Hatle | 25 Feb 17:52

Re: zlib gzprintf() patch (ack)

Mark Hatle wrote:
> Is this due to an audit?  Or did you find a problem/crash w/ errant data?
> 
>> The Owl change log entry is:
>>
>> 2003/02/25    Package: zlib
>> Corrected a potential buffer overflow in gzprintf(), thanks to Bugtraq
>> postings by Crazy Einstein, Richard Kettlewell, and Carlo Marcelo
>> Arenas Belon.

obviously I can't read.. so I'm going to shutup now.

--Mark