Vulnerability Development mailing list archives

Re: Links segfault

From: Petr Baudis <pasky () pasky ji cz>
Date: Sat, 22 Sep 2001 20:03:18 +0200

Is possible that someone inject a shellcode from his website?
Every sessions links are finished after that:


IMHO this is just a bug in links.

yeah, i forwarded it onto links mailing list. imho it is generally
not possible to inject shellcode or so.. no overflow or similiar.

 <td><menu>
 <li type="circle"><pre>A<pre>
 </menu>


Seems that <menu> tag in combination with a <pre> within
a table is the problem. If you removed one of the tags
the error is gone.

<html>
<head></head>
<body>
<table><tr><td><ul><li><pre>A</pre></ul></td></tr></table>
</body></html>

is the minimal version.

a space around fixes that as well. i hope Mikulas will fix it
in the next version, as i'm getting a serious headache from
renderer code ;-).

-- 

                                Petr "Pasky" Baudis
.                                                                       .
#define BITCOUNT(x)     (((BX_(x)+(BX_(x)>>4)) & 0x0F0F0F0F) % 255)
#define  BX_(x)         ((x) - (((x)>>1)&0x77777777)                    \
                             - (((x)>>2)&0x33333333)                    \
                             - (((x)>>3)&0x11111111))
             -- really weird C code to count the number of bits in a word
.                                                                       .
My public PGP key is on: http://pasky.ji.cz/~pasky/pubkey.txt
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS d- s++:++ a--- C+++ UL++++$ P+ L+++ E--- W+ N !o K- w-- !O M-
!V PS+ !PE Y+ PGP+>++ t+ 5 X(+) R++ tv- b+ DI(+) D+ G e-> h! r% y?
------END GEEK CODE BLOCK------

Current thread:

Links segfault Matias Sedalo (Sep 20)
- Re: Links segfault Thomas Graf (Sep 21)
  - Re: Links segfault Petr Baudis (Sep 22)