Security bugfix (low risk): dynamically allocate space for group name Security bugfix (low risk): dynamically allocate space for group name plus space character in do_group rather than overflowing it's caller's dynamically-allocated string.
Security bugfix (low risk): dynamically allocate space for group name
Security bugfix (low risk): dynamically allocate space for group name
plus space character in do_group rather than overflowing it's caller's
dynamically-allocated string.

Bug was observed and tracked down by Mike Castle <dalgoda@ix.netcom.com>.
Thanks a lot.

As we're not overflowing an "auto" storage class variable here, the data
will not be on the stack, so just pushing shell code into the variable
will be rather useless, and the attack would be rather difficult to
deploy: the server would have to toss down shell code without NUL and
LF, could not use CR everywhere, and it would need to trick a client
into marking this group for fetching.

BackupTheBerlios/leafnode,BackupTheBerlios/leafnode,BackupTheBerlios/leafnode,BackupTheBerlios/leafnode