6359831 2001-04-12 17:24 -0400 /44 rader/ Sylvain Robitaille <syl@ALCOR.CONCORDIA.CA>
Sänt av: joel@lysator.liu.se
Importerad: 2001-04-13 07:55 av Brevbäraren
Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM
Externa svar till: syl@ALCOR.CONCORDIA.CA
Mottagare: Bugtraq (import) <16507>
Kommentar till text 6358568 av William D. Colburn (aka Schlake) <wcolburn@NMT.EDU>
Ärende: Re: ntp-4.0.99k23 had been updated
------------------------------------------------------------
From: Sylvain Robitaille <syl@ALCOR.CONCORDIA.CA>
To: BUGTRAQ@SECURITYFOCUS.COM
Message-ID: <200104122124.RAA31899@alcor.concordia.ca>
William Colburn wrote:
> The package is newer as of today.
True enough, but I have the impression that there are more changes
there than just the area of code that's affected by the buffer
overflow that triggered the start of this thread. Can anyone confirm
this?
I've looked and I *believe* the only difference relevant to this
discussion between today's ntp-4.0.99k23 and last Friday's is the
appended patch. If anyone believes there are more relevant
differences could you please point them out?
--
----------------------------------------------------------------------
Sylvain Robitaille syl@alcor.concordia.ca
Systems analyst Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------
--- ntpd/ntp_control.c.20010412 Mon Apr 9 15:47:20 2001
+++ ntpd/ntp_control.c Thu Apr 12 17:11:47 2001
@@ -1759,9 +1759,11 @@
}
if (cp < reqend)
cp++;
- *tp = '\0';
- while (isspace(*(tp-1)))
- *(--tp) = '\0';
+ while (tp > buf) {
+ *tp-- = '\0';
+ if (!isspace((int)(*tp)))
+ break;
+ }
reqpt = cp;
*data = buf;
return v;
(6359831) /Sylvain Robitaille <syl@ALCOR.CONCORDIA.CA>/(Ombruten)