Wireshark-bugs: [Wireshark-bugs] [Bug 5686] /epan/emem.c Fails to Check Entire ep_ Canary
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 24 Feb 2011 19:20:42 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5686

Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |jeff.morriss.ws@xxxxxxxxx
         Resolution|                            |INVALID

--- Comment #1 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2011-02-24 19:20:40 PST ---
That 8th byte is usually NULL to serve as a separator between the canary and
the pointer to the next canary: you can see how it is used at the end of
emem_alloc_chunk().

I added a (hopefully explanatory) comment in rev 36065.

(If you make the change you proposed, you'll find that memory corruption is
always detected--because we end up comparing the NULL separator to the random
canary value.)

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.