2001-05-16 -+- Frank -+- -+- Great article! But I think there is a mistake in your description
of the strncat function. Let me quote:
> Replacing strcat(buffer1, buffer2);
> with strncat(buffer1, buffer2, sizeof(buffer1)-1);
> eliminates the risk.
However, my system's man page for strncat(3) says:
> The strncat() function is similar [to strcat], except that only the
> first n characters of src [=buffer2] are appended to dest [=buffer1].
That means that the correct strncat call would be:
strncat(buffer1, buffer2, sizeof(buffer1)-1-strnlen(buffer1, sizeof(buffer1)-1));
Doing it this way should assure that buffer1 doesn't overflow,
but I haven't tested it. 2001-05-29 -+- Fred Raynal -+- pappy@users.sourceforge.net -+- Frank, I guess you just prove that cut/paste is a bad way to write an article ;-/
Of course, you are right and we made a mistake, Thanks for fixing it :)

The authors (ashamed) 2003-04-25 -+- G Salmon -+- fisher143@hotmail.com -+- Are there any exploits out there that can successfully conduct buffer overflows against the Heap? -+- 68.48.49.96 = Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; H010818)