Re:Nweb: a tiny, safe web server (static pages only)
by nknighthb on Monday March 31, 2014 @10:56PM
(#7505896)
It's scary style (and speaking of style, this code is really inconsistent in its formatting), but from a quick search of the usages of the logger function, I didn't see any way to overflow the buffer.
* BUFSIZE is 8096.
* logbuffer (the local variable) is BUFSIZEx2
* s1 looks like it's always trusted and an order of magnitude smaller than BUFSIZE.
* The format strings and numbers are nowhere near big enough to make up the difference.
* Where s2 is untrusted data, I think it's always guaranteed to be <=BUFSIZE and zero-terminated.
But there are definitely other possible issues I haven't looked at closely, and I'm certainly troubled that this mess has showed up on an IBM site as an example of a "safe" web server.
* BUFSIZE is 8096.
* logbuffer (the local variable) is BUFSIZEx2
* s1 looks like it's always trusted and an order of magnitude smaller than BUFSIZE.
* The format strings and numbers are nowhere near big enough to make up the difference.
* Where s2 is untrusted data, I think it's always guaranteed to be <=BUFSIZE and zero-terminated.
But there are definitely other possible issues I haven't looked at closely, and I'm certainly troubled that this mess has showed up on an IBM site as an example of a "safe" web server.