Comments on: fishy FiSH

By: tomten

tomten — Thu, 16 Oct 2008 05:43:23 +0000

Problems with libfish and sparc

Problems with libfish and sparc
Hi, I’m having trubbel with libfish. Don’t like it muth, it has problems with operating on difrent archs. I run sparc64, and when i try to decode a msg from a intel machine all i get is junk! Think its a problem with the bytorder….

Great work on the blogg, hope to read more soon.

This comment was originally posted on 20080723T09:43:29

By: ilja

ilja — Thu, 16 Oct 2008 05:43:22 +0000

I didnt have to see that, I just barfed up my dinner.

This comment was originally posted on 20070328T03:37:39

By: oxff

oxff — Thu, 16 Oct 2008 05:43:21 +0000

He prevents Buffer Overflows!

He prevents Buffer Overflows!
FiSH-irssi-v0.99-source.zip:FiSH.c:79

// usually a received message does not exceed 512 chars, but we want to prevent evil buffer overflow
if(msg_len >= (int)(sizeof(bf_dest)*1.5)) msg_ptr[(int)(sizeof(bf_dest)*1.5)-20]=”;

Isn’t that cute?

This comment was originally posted on 20070328T00:59:18

By: calcite

calcite — Thu, 16 Oct 2008 05:43:20 +0000

Wow

Wow
I’m suprised to see strcpy() fuckup like that in such a widely used application.

This comment was originally posted on 20070325T03:34:24

By: ilja

ilja — Thu, 16 Oct 2008 05:43:19 +0000

the fact that it has to be serverside in most cases is pretty obvious, and imo needn’t even be mentioned. also it looks like you might be able to trigger the notice stacksmash clientside.
I didn’t know the xchat code was that different from the mirc code, I never looked, I just assumed, hence the “I believe …” I wasn’t stating facts.

This comment was originally posted on 20070320T04:16:12

By: slashy

slashy — Thu, 16 Oct 2008 05:43:18 +0000

well done research.. a bit further and you would have noticed that you can’t attack this without full control of the ircserver (or you have to find irc-servers which have a nicklen setting > 100). Also it should be mentioned that this flaws only applies to xchat version .. the flawed part of the code ain’t reused in mIRC version past 1.25

read here for more: http://fish.sekure.us/forum/viewtopic.php?p=1166#1166

This comment was originally posted on 20070317T11:08:30

By: sacrine

sacrine — Thu, 16 Oct 2008 05:43:17 +0000

RE:

RE:
Echte mannen gebruiken FiSH ?

I don’t think so :)

This comment was originally posted on 20070308T09:16:31

By: prdelka

prdelka — Thu, 16 Oct 2008 05:43:17 +0000

Month of retro bugs! :-D

This comment was originally posted on 20070315T14:00:47