Re: Format string bug becomes buffer overflow, because of bad length assumption

Quoting Gerardo Di Giacomo <gerardo@xxxxxxxx>:

> I think that this situation is the paradise for the exploit coder :)
> Btw, did you find some similar situation?

Well, the Emacs mail program Mew has something similar in its help program
incm:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278883

It isn't suid or sgid anything, but it shows that this type of code exists in
real life. Scary eh!?

-- 
Ulf Harnhammar
http://www.advogato.org/person/metaur/