PatR cf7536b167 random_response() buffer overflow ...

'sz' is the size of the buffer; 'if (count < sz) buf[count++] = c;'
can fill the entire buffer, leaving count==sz, so buf[count] = '\0';
would be out of bounds.

Formatting was way off.  Indentation these days should be multiples
of 4 spaces, never tabs.

2018-12-13 02:12:31 -08:00

26 KiB

Raw Blame History

View Raw