Bugtraq: false alarm: query cgi problem

[apropos () sover net (Apropos of Nothing)]

For anyone who cares, the buffer overflow in the query cgi is not
exploitable.  This is because the exploit requires 21,000+ bytes, and the
maximum size for a URL is 1024 bytes. That is how it is defined in the RFC.


Anyway, consider yourselves lucky since that stops all attacks on query.c
based cgis. (phf, post-query, query, and maybe others have the same buffer
overflow problem).

Of course, it wouldn't hurt to a make getword() et al. do bounds checking.

apropos of nothing