format string attack on dbug.c
| Bugzilla Link | 694 |
| Created on | Apr 07, 2010 21:33 |
| Resolution | FIXED |
| Resolved on | Apr 09, 2010 13:56 |
| Version | svn |
| OS | Linux |
| Architecture | PC |
Extended Description
Some of my students from the compiler course found a flaw in the current implementation of the dbug package (formerly known as Fred Fish). http://en.wikipedia.org/wiki/Format_string_attack In essence, function arguments are directly used as printf format strings, which is a security hole and at least bad programming practice.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information