Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Bugtraq: Re: the purpose of dynamic memory allocation

Re: the purpose of dynamic memory allocation

From: Jeffrey Hutzelman <jhutz+_at_cmu.edu>
Date: Tue, 10 Mar 1998 20:07:21 -0500

> Along the same lines, I've seen the following occur:
>
> while(bytes = recv(sock, buf, bufsize, 0))
> write(fd, buf, bytes);
>
> Normally, recv fails with a 0, but if things go wrong, it will fail with a
> -1. The third argument to write is UNSIGNED. If that occurs, we'll start
> at the addr of buf, and attempt to write 4GB to the fd. This is just one
> example of why I do not consider signed-unsigned mismatch warnings to be
> inconsequential.

recv returns the number of bytes received, or -1 if there is an error.
The only way it can return 0 is if a 0-byte message is received
(e.g. a 0-length UDP packet). While I'll agree that complaints about
size and signed-ness mismatches are a Good Thing, the above code
suffers from the (IMHO) much worse problem of failing to check for
an error return from recv....

-- Jeffrey T. Hutzelman (N3NHS) <jhutz+@cmu.edu>
   Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA
Received on Mar 10 1998

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos