8213928 2002-03-28 06:24 +0000  /35 rader/ Wu Tao <lepton@sina.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-03-28  23:57  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <21625>
Ärende: A possible buffer overflow in libnewt
------------------------------------------------------------
From: Wu Tao <lepton@sina.com>
To: bugtraq@securityfocus.com
Message-ID: <20020328062422.10578.qmail@mail.securityfocus.com>



Hi!
When I am debugging my little program which used 
libnewt,I found a possible buffer overflow in libnewt.
libnewt is widely used by configuration program in 
redhat.Because there is no suid program use libnewt 
in my redhat 6.2 environment,it seems this bug can't 
be used to gain root.But if there is any suid program 
use libnewt,it is dangerous.
The following is my patch for libnewt 0.5.33.
I have mailed the author of libnewt about a week ago,
but I have got no reply.

diff -ur newt-0.50.33/newt.c newt-0.50.33-n/newt.c
--- newt-0.50.33/newt.c Wed Apr  4 03:33:10 2001
+++ newt-0.50.33-n/newt.c       Tue Mar 19 21:41:24 
2002
@@ -331,6 +331,8 @@
        }

        *chptr++ = key;
+       if(chptr-buf>8)
+               break;

        /* this search should use bsearch(), but when 
we only look through
           a list of 20 (or so) keymappings, it's probably 
faster just to
(8213928) /Wu Tao <lepton@sina.com>/----------------