|
|
| |
|
| |
xchat-ruby: null pointer dereference, remote DoS
| Package(s): | xchat-ruby |
CVE #(s): | |
| Created: | February 13, 2012 |
Updated: | February 15, 2012 |
| Description: |
From the Red Hat bugzilla:
In src/xchat-ruby.c functions
static_ruby_custom_command_hook(char *word[], char *word_eol[], void *userdata)
static_ruby_custom_server_hook(char *word[], char *word_eol[], void *userdata)
parameter 'word' used in a for cycle without break [1]
for( i = 1; word[i][0] != '\0'; i++ )
The problem is word[PDIWORDS] always set to NULL by xchat. So if the input
contains more words than PDIWORDS (32) [2], the NULL pointer will be
dereferenced.
This bug remote triggerable over IRC networks if one or more ruby plugin uses
hook_server(). |
| Alerts: |
|
( Log in to post comments)
|
|
|