Re: lynx-dev lynx getenv() overflow

[Philip Webb]

990118 Jorge told us:
> Fix your bugs.
> It segfaults when you set your HOME envar to  >= 260  characters.
> It is exploitable, though I don't see why you'd want to,
> but I wrote it to those who are nonbelievers.

this doesn't say what `it' is, but the following suggests you mean `Lynx'.
 
> linux lynx overflow. what is it for? example code.
> my linux 2.0.35 boxen lynx 2.6 but i know that 2.8 is vuln as well
> because i did it on a debian system with lynx 2.8.

Lynx 2-6 is  2,5 years  out-of-date; 2-8  1 year  out-of-date.
for the latest 2-8-1 (9810) goto  www.slcc.edu/lynx/release/ ;
for the latest development version goto  sol.slcc.edu/lynx/current/ .

i tested your claim on this IRIX 5.3 system with  setenv HOME 'zeros' ,
where  zeros  = a set of  >= 300  0's; executing Lynx 2-8-1rel.1
encountered no problem beyond failing to find the bookmark file.

fix your sox?  they look like they're round your ankles ... (smile).

-- 
========================,,============================================
SUPPORT     ___________//___,  Philip Webb : address@hidden
ELECTRIC   /] [] [] [] [] []|  Centre for Urban & Community Studies
TRANSIT    `-O----------O---'  University of Toronto