Re: Another Netscape Bug (and possible security hole)

At 07:33 1995.09.22 GMT, Jeff Weinstein wrote:
>In article <199509220612.CAA11441@clark.net>, rjc@clark.net (Ray Cromwell)
writes:
>> I've found a Netscape bug which I suspect is a buffer overflow and
>> may have the potential for serious damage. If it is an overflow bug,
>> then it may be possible to infect every computer which accesses a web
>> page with Netscape. To see the bug, create an html file containing
>> the following:
>
>  Thanks for the report.  I will make sure that this is fixed.
>
>	--Jeff

Don't just look at this bug, though... check ALL your static buffers and
include code to check for overflow writes.  For example, if Netscape is
written in C or C++ and the above code uses strcpy(), you could change
strcpy() to strncpy() everywhere (and then set the last char to null in case
strncpy() didn't).  Your programmers will know what I mean.

Herb

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Herb Sutter                 2228 Urwin, Suite 102       voice (416) 618-0184
Connected Object Solutions  Oakville ON Canada L6L 2T2    fax (905) 847-6019

On Fri, 22 Sep 1995 09:47:35 -0400, herbs@interlog.com (Herb Sutter)
wrote:
 
> Don't just look at this bug, though... check ALL your static buffers and
> include code to check for overflow writes.  For example, if Netscape is
> written in C or C++ and the above code uses strcpy(), you could change
> strcpy() to strncpy() everywhere (and then set the last char to null in case
> strncpy() didn't).  Your programmers will know what I mean.

Better yet, ban both strncpy and strncat.  Replace them with
differently-named routines (strbcpy and strbcat?) that, given a buffer
length, are GUARANTEED to always give you a properly terminated string
that (including the terminator) does not overflow the specified
buffer.

Even better, use a good string class that does all this automatically
all the time.

PGP message