apache
Function "ap_get_win32_interpreter" writes one additional byte into a buffer when WIN32.
Bug fixed by commit 664e3aac6dd
| Type | BufferOverflow |
| Config | "WIN32" (1st degree) |
| Fix-in | code |
| Location | main/ |
#include <stdlib.h>
#include <string.h>
#ifdef WIN32
void ap_get_win32_interpreter()
{
char buffer[1024];
int i;
if (rand() % 2) {
for (i = 0; i < sizeof(buffer); i++) {
//do something
}
buffer[i] = '\0';
}
}
#endif
int main(void)
{
#ifdef WIN32
ap_get_win32_interpreter();
#endif
return 0;
}
. call main/http_core.c:953:ap_get_win32_interpreter() . 1044: for (i = 2; i < sizeof(buffer); i++) . // after this for loop, i = sizeof(buffer) . ERROR 1050: buffer[i] = '\0';