Re: Voulnerability in 3.*-4.*

> > I don't need access, just a little PHP example script that causes the > > problem. So, you are saying that: > > > > <? > > unlink("/foo/foo/foo/blah"); > > ?> > yes, like so. > Also, try to compile and run: > -------------------------------------------- > #include <stdio.h> > #include <unistd.h> > #include <sys/stat.h> > > char fn[]="/foo/foo/foo/blah"; > main() > { > char *s; > > s = (char*)strrchr(fn,'/'); > > while(s && *(s+1)=='\0' && s>fn) { > s='\0'; > s = (char*)strrchr(fn,'/'); > printf("Mamma\n"); > } > } > --------------------- > Can You see Mamma on output? > And try to put "/" at the end of fn.... Ah, right, so the bug is simply that it should be *s='\0'; inside the loop there. Silly typo. -Rasmus