[fol] Re: C$B%3%s%Q%$%i!<$N4pK\3NG'(B

[Tadasuke YAMAGUCHI <tadasuke@xxxxxxxxxxxxxxxx>]

$B;38}$G$9!#(B

>> >   gets()$B$r;H$C$?%W%m%0%i%`$O4m81$G$9$+$i!"(Bgets()$B$r;H$o$J$$$N$,(B
>> > $B:GA1$N(B($BM#0l$N(B)$B2r7hJ}K!$@$H;W$$$^$9!#(B
>> > 
>> > 	$B$F$J>o<1$,=q$+$l$F$k>l=j$H$+$"$k$N$+$J(B		  $B5WLn(B
>> 
>> gets$B$GC5$9$h$j!"(Bstack overflow$B$H$+$GC5$7$?J}$,8+$D$+$k$s$G$7$g$&$M!#(B

http://www.ipa.go.jp/security/fy14/reports/oss_security/part2.pdf
$B!V8zN(E*$J%=!<%9%3!<%I8!::5;=Q$ND4::!W$H$$$&%?%$%H%k$G(BRATS$B$N>R2p(B
$B$,$5$l$F$^$9!#$=$3$G$ONc$($P(BC$B8@8l$J$s$+$@$H(B

  buffer overflow$B$r0z$-5/$3$92DG=@-$N9b$$4X?t$NNc(B
     gets, strcpy, strcat, printf, sprintf, scanf, sscanf, fscanf,
     vfscanf, vsprintf, vscanf, vsscanf, streadd, strecpy, strtrns,
     getchar, fgetc, fgets, fprintf

$B$J$I$H5s$2$i$l$F$^$9!#(B

$B$"$H!"$3$l$NMm$_$+$3$NB3$-$@$C$?$+$G!"$3$&$$$C$?4X?t$r;H$C$F$$$F$b!"(B
$B4V$K(Bwrapper$B$r$+$^$7$F@H<e@-$r$H$C$Q$i$*$&!"$J$s$F;n$_$b$"$C$?$H;W$$(B
$B$^$9!#(B
-- 
 Tadasuke YAMAGUCHI @ Hyogo