Bugtraq: Re: ncurses buffer overflows

[Brett Lymn <blymn () BAESYSTEMS COM AU>]

According to =?iso-8859-1?Q?Jouko_Pynn=F6nen?=:
> The problem has been tested and found on
FWIW - no version of NetBSD is distributed with ncurses as the base
curses library, it is available in the package system as an addon.
There are no str* calls performed on user supplied data (including the
termcap information) and we use a new termcap interface that bounds
checks information from the termcap entries.  An audit of the NetBSD
source tree was performed in May to replace the old, unbounded,
termcap interface with the updated one.

Hint:  how many programs in _your_ source tree use tgetstr (perhaps
none which is a good thing)?

--
===============================================================================
Brett Lymn, Computer Systems Administrator, BAE SYSTEMS
===============================================================================