[bug #19923] root-only buffer overrun in locate from findutils-4.3.x

[anonymous]

Follow-up Comment #1, bug #19923 (project findutils):

Um, if one byte of `what' was always what was overwritten, then
-fstack-protector wouldn't have caught this problem. The guard (adjacent to
`what') must have been smashed. (This won't smash the return address on
32-bit hosts and will probably not do so on 64-bit hosts either: I'd say
`certainly not' only I don't have any 64-bit hosts here to test against.)

(However, I seem to recall that -fstack-protector reorders variables as well
as canarying them, in which case your statement is correct when the stack
protector is off. I can't recall. Sorry.)

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?19923>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/