[Midnight Commander] #241: buffer overflow in __mhl_str_concat_hlp

[Ticket System]

#241: buffer overflow in __mhl_str_concat_hlp
---------------------------------------------------+------------------------
  Reporter:  Patrick Winnertz <winnie at debian.org>  |       Owner:  winnie           
      Type:  defect                                |      Status:  accepted         
  Priority:  major                                 |   Milestone:  4.6.3            
 Component:  mc-core                               |     Version:  4.6.2            
Resolution:                                        |    Keywords:  review vote-metux
  Blocking:                                        |   Blockedby:                   
---------------------------------------------------+------------------------
Changes (by metux):

  * keywords:  review => review vote-metux


Old description:

> Hey,
>
> There is currently a bufferoverflow in __mhl_str_concat_hlp if the
> function is
> called with more than 32 parameters.
>
> This will fix this:
> {{{
> while ((a = va_arg(args, char*)) != (char*)1 && count <=31) { ... }
> }}}

New description:

 Hey,

 There is currently a bufferoverflow in __mhl_str_concat_hlp if the
 function is
 called with more than 32 parameters.

 This will fix this:
 {{{
 while ((a = va_arg(args, char*)) != (char*)1 && count <=31) { ... }
 }}}

--

-- 
Ticket URL: <www.midnight-commander.org/ticket/241#comment:3>
Midnight Commander <www.midnight-commander.org>
Midnight Development Center