From owner-freebsd-security Thu Jun 27 8:50:48 2002 Delivered-To: freebsd-security@freebsd.org Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193]) by hub.freebsd.org (Postfix) with ESMTP id 15E2B37B400 for ; Thu, 27 Jun 2002 08:50:21 -0700 (PDT) Received: from khavrinen.lcs.mit.edu (localhost [IPv6:::1]) by khavrinen.lcs.mit.edu (8.12.3/8.12.3) with ESMTP id g5RFntDK031653; Thu, 27 Jun 2002 11:49:55 -0400 (EDT) (envelope-from wollman@khavrinen.lcs.mit.edu) Received: (from wollman@localhost) by khavrinen.lcs.mit.edu (8.12.3/8.12.3/Submit) id g5RFnsWb031650; Thu, 27 Jun 2002 11:49:54 -0400 (EDT) (envelope-from wollman) Date: Thu, 27 Jun 2002 11:49:54 -0400 (EDT) From: Garrett Wollman Message-Id: <200206271549.g5RFnsWb031650@khavrinen.lcs.mit.edu> To: Marc Slemko Cc: security@FreeBSD.ORG Subject: Re: FreeBSD vuln... In-Reply-To: References: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org < said: > No question, the real bug is in Apache for passing in a negative > length, however the particular exploit only works due to some very > interesting details of how memcpy() is doing things that could arguably > be called wrong. The length parameter to memcpy is unsigned. There is no such thing as `passing a negative length to memcpy'. One can, of course, pass an extremely large positive length to memcpy, generated by converting a negative signed integer to an unsigned integer on a two's-complement machine. -GAWollman To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message