Matt
Benjamin J Stassart <dszd0g@dasb.fhda.edu> writes:
> [...]
>
> Also, unless I am mistaken it appears you could over-run one of the
> buffers in authuser.c with spaces or tabs. What this would be able to
> accomplish I do not know, but it should be fixed.
>
> while ((w = read(s, &ch, 1)) == 1) {
> *buf = ch;
> if ((ch != ' ') && (ch != '\t') && (ch != '\r'))
> ++buf;
> if ((buf - realbuf == sizeof(realbuf) - 1) || (ch ==
> '\n'))
> break;
> }
>
> Switching the if statements should fix the problem I believe?
>
> [...]
>
> As for ease of overflowing the buffer, I would say pretty easy. I have
> hacked up pidentd source quite a bit. It is not difficult. Since the
> buffer is just read directly from the socket, well...
>
> Benjamin J. Stassart