Re:Sizeof(char) is 1
by psyklic on Monday September 06, 2010 @02:05AM
(#1666033)
(1) sizeof is evaluated at compile time, so it would evaluate to (1 * strlen(params->text)), which the compiler would then optimize to just strlen(params->text). So, sizeof() is not exploitable.
(2) A terminating null character is placed at the end of strings, not at the end of allocated memory. malloc does not alter the memory before it returns a pointer to it; it is up to the programmer to ensure he is writing in the proper area.
Re:Sizeof(char) is 1
by chc on Monday September 06, 2010 @02:08AM
(#1666037)
The fact that it's strlen(params->text) is precisely why it's exploitable. If we intend to write strlen(params->text)+1 bytes and allocate less, we've set ourselves up for a buffer overrun.
(2) A terminating null character is placed at the end of strings, not at the end of allocated memory. malloc does not alter the memory before it returns a pointer to it; it is up to the programmer to ensure he is writing in the proper area.