Menu
▾
▴
#35 Crash by buffer overflow
1) when forwarding to a ntlm-requesting proxy,
mman crashes.
The character array buf[128] in file header.c
line 100 is too small.
see appended patch.
2) cannot make debug-version (file main.c)
because some variables are #ifdef'ed out
see appended patch.
3) cannot negotiate with proxy, i searched
a debug-flag showing the authentication dialogue,
found none.
please implement this switch!
sincerely, peter
peter
DOT
gsellmann
AT
eunet
DOT
at
Output of diff -aurp
Logged In: YES
user_id=432781
Thanks for the bug report.
The buffer overflow in header.c is now fixed in CVS, I didn't use the
patch you submitted because I'd rather avoid using alloca (it's not
portable).
The undefined variable bug is also now fixed in CVS.
As for the NTLM negotiation, I'm unsure what the problem could be... I
have no way of testing it out so it was written entirely based on what
little information is available on NTLM... if you could provide something
like a packet capture of the negotiation that might help.
Thanks.
Logged In: YES
user_id=1005620
negotiation dump: the ntlm-auth is what i need, so i do some
sort of 'testing'
In file smbutil.c i see functions like dumpSmbNtlmAuth*()
but they are not called from any point.
It would be fine to have a debug-flag MMLOG_AUTH
which should call these functions at appropriate points.
ps. just by curiosity: which platform lacks the 'alloca' ? it is as
simple as subtracting some value from the stackpointer.
Logged In: YES
user_id=432781
Ok, I'll look into adding better NTLM debuggin when I get a chance, I'm
a little tied up with other things ATM.
About alloca... here's an exert from the manpage:
The alloca function is machine and compiler dependent. On many
systems its implementation is buggy. Its use is discouraged.
On many systems alloca cannot be used inside the list of
arguments of a function call, because the stack space reserved by
alloca would appear on the stack in the middle of the space for
the function arguments.
Logged In: YES
user_id=1005620
alloca:
I think someone should rewrite this manual page. It seems to
be very old and misleading.
Gcc itself (ver 2.95.3) uses alloca() ~600 times and gcc
seems to be portable.
I am very paranoid against text-buffers with fixed size. There
is always a situation the buffers are too small, especially if
the data comes from outside of the process.
The text-line which was too long seems to be a clear-text
entered by the system-administrator of the ms-proxy and
thus is only as reasonable as the ms-sys-admin itself :-)
Please think of the intellectual sanity of all sys-admins
installing a proxy which can only be used with IE and make all
buffers of dynamic size!
peter.
Logged In: YES
user_id=1005620
alloca:
I think someone should rewrite this manual page. It seems to
be very old and misleading.
Gcc itself (ver 2.95.3) uses alloca() ~600 times and gcc
seems to be portable.
I am very paranoid against text-buffers with fixed size. There
is always a situation the buffers are too small, especially if
the data comes from outside of the process.
The text-line which was too long seems to be a clear-text
entered by the system-administrator of the ms-proxy and
thus is only as reasonable as the ms-sys-admin itself :-)
Please think of the intellectual sanity of all sys-admins
installing a proxy which can only be used with IE and make all
buffers of dynamic size!
peter.