Vulnerability Development mailing list archives

Re: long file names in explorer.exe


From: rsavage () CROSSWINDS NET (Rory Savage)
Date: Fri, 28 Apr 2000 17:58:08 -0400


kj,

I suspect that explorer concatenates long file names rather than causing a
buffer overflow. Why the prefixes of the files included a ~ and odd
charactes? I don't know, it just might be random data. But notice
that the prefixes are four characters long E~XX.XXX. This might happen
as a last resort to keep the file names under the 8.3 file standard.
 What does microsoft have to say about this?

Rory Savage

--
Systems Administrator
 email: rsavage () crosswinds net
.-.-.-..---..-..-..---.
| | | || | || .` || |'_
`-----'`-^-'`-'`-'`-'-/
-=/ MCI WorldCom/WANG/FAA \=-
 work (919)-377-7702
 beep (800)-PAGE-MCI
 page mail: 1433539 () pagemci com

On Wed, 26 Apr 2000, kj wrote:

Hey, all

I have done a few tests on NT 4.0 (SP5) and Windows 2000 (build 2128) creating
long file name extensions and trying to copy and view them in explorer.exe.

Both OS' did not crash when the tool tips displayed the long extensions, but
I did notice other "odd" behavior.

I had 4 files that I was playing with

c.`perl -e 'print "a" x 232'`

e.`perl -e 'print "a" x 240'`

e.`perl -e 'print "f" x 250'`

f.`perl -e 'print "f" x 247'`

From samba to WINNT
Copying the files to another computer through network neighbourhood:
"c.aaa..." recieved "file extension is too long"
"e.aaa..." recieved an error that "file cannot find the specified path..."
"e.fff..." became "E~lh.fff"
"f.fff..." became "F~ki.fff"

Copying to the same directory as what the files were already in (on samba):
"c.aaa..." crashed explorer.exe
"e.aaa..." crashed explorer.exe
"e.fff..." became "E~LH.FFF"
"f.fff..." became "F~KI.FFF"


I have only tested samba and WINNT. I have yet to try Win2000...though I
plan to tomorrow.

K.J.

--

"Never argue with an idiot. He will take you down to his level, and beat
you with experience."





Current thread: