Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG

[Alex]

On Mon, Aug 10, 2015 at 11:03 AM, Paul Eggert <eggert@cs.ucla.edu> wrote:
> Alex wrote:
>>
>> I've been trying to figure
>> out why the original author used strndupa in the first place but
>> haven't wrapped my mind around it yet.
>
> Presumably the original author didn't know about "%.*s".  The string is not
> null-terminated, so "%s" won't work, and I guess the original author used
> strndupa to create a null-terminated copy.
>
> Beware of int overflow when using "%.*s", by the way.

Thanks to Paul Eggert and Andreas Schwab for your helpful feedback! It
turns out that implementing the recommended fix will require a small
tweak in _dl_debug_vdprintf. I will send a v2 patch after testing.

AD