apache
Function "ap_get_win32_interpreter" writes one additional byte into a buffer when WIN32.
Bug fixed by commit 664e3aac6dd
Type | BufferOverflow |
Config | "WIN32" (1st degree) |
Fix-in | code |
Location | main/ |
#include <stdlib.h> #include <string.h> #ifdef WIN32 void ap_get_win32_interpreter() { char buffer[1024]; int i; if (rand() % 2) { for (i = 0; i < sizeof(buffer); i++) { //do something } buffer[i] = '\0'; } } #endif int main(void) { #ifdef WIN32 ap_get_win32_interpreter(); #endif return 0; }
. call main/http_core.c:953:ap_get_win32_interpreter() . 1044: for (i = 2; i < sizeof(buffer); i++) . // after this for loop, i = sizeof(buffer) . ERROR 1050: buffer[i] = '\0';