Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
X-Apparently-From: <earnie?boyd AT yahoo DOT com>
Message-ID: <3A92C85D.E735E49D@yahoo.com>
Date: Tue, 20 Feb 2001 14:41:17 -0500
From: Earnie Boyd <earnie_boyd AT yahoo DOT com>
Reply-To: Earnie Boyd <cygwin AT cygwin DOT com>
X-Mailer: Mozilla 4.76 [en] (WinNT; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Reuben Thomas <rrt1001 AT cam DOT ac DOT uk>
CC: cygwin AT cygwin DOT com
Subject: Re: mingw > 20001111: fstat bug: buffer overflow?
References: <Pine DOT LNX DOT 4 DOT 33 DOT 0102201240330 DOT 1238-100000 AT localhost DOT localdomain>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Reuben Thomas wrote:
> 
> In mingw versions later than 20001111, i.e. 20001225 and 20010130, fstat
> seems to overrun the stat buffer passed to it. This is illustrated by the
> following program, in which if a simple struct stat is passed to test, foo
> crashes when it tries to return (presumably the return address is
> overwritten). If a struct bar (with extra padding before and after the
> struct stat) is used instead, there is no error.
> 
> >From looking at /usr/include/mingw/stat.h, it seems that there are at least
> two different versions of struct stat in play, potentially with different
> types, but I don't claim to understand what's going on.
> 
> #include <stddef.h>
> #include <stdio.h>
> #include <sys/stat.h>
> 
> struct bar {
>   double a;
>   struct stat sb;
>   double b;
> };
> 
> int test(void) {
> /* either */
>   struct bar s;
>   printf("%d\n", fstat(1, &(s.sb)));
> /* or
>   struct stat sb;
>   printf("%d\n", fstat(1, &sb));
> */
>   return 0;
> }
> 
> int foo(void) {
>   fprintf(stderr, "%d\n", test());
>   fflush(stderr);
>   return 1;
> }
> 
> int main(void) {
>   printf("%d\n", foo());
>   return 0;
> }
> 

I just tried the above test with gcc-2.95.2-7.  I don't see the problems
you do.  I tried both of you versions of structure.  I did
  gcc -mno-cygwin -mwin32 -D__MSVCRT__ foo.c
  ./a
    0
    0
    1

I also tried a variation of your example where I use _fstat instead of
fstat.  The results were the same.  I suggest that instead of fstat that
you do use _fstat.

Earnie.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com


--
Want to unsubscribe from this list?
Check out: http://cygwin.com/ml/#unsubscribe-simple