🚀 go-pugleaf

Hello,

I have found a major problem with all versions (including 1.40)
of MERCURYS.NLM module. The program does not check if a product
of [v]sprintf() function can be located within temporary space 
allocated on the stack!

The trivial error can cause a stack corruption, bringing down 
(ABEND) the entire NetWare server. You can exploit the bug by 
sending very long (>255 characters) parameter with "HELO" command,
during initial stage of SMTP session.

Inspired by the problem, I have written a small utility called
SPRINTFX.NLM, available at address:

   http://www.cpu.lublin.pl/~artur/sprintfx/sprintfx.nlm

SPRINTFX.NLM implements its own SpRiNtF() and VsPrInTf() functions,
which limit by default the maximum size of a result to 200 characters.

The utility can modify table of external symbols of any NetWare
Loadable Module (excluding itself) in order to intercept calls
to the original sprintf() and vsprintf() functions. To fix 
a module which uses the functions in a cereless manner you should:

   1. copy SPRINTFX.NLM to SYS:SYSTEM directory;
   2. make a backup copy of the original module;
   3. unload the original module;
   4. issue command "LOAD SPRINTFX.NLM <FULL-PATH-TO-CARELESS-MODULE>"
      on the NetWare server console.

The command in step 4 modifies a buggy module (i.e. MERCURYS.NLM)
and loads the module again. There is no need to load SPRINTFX.NLM
utility separately during system startup. SPRINTFX.NLM interts
its name to the table of library modules used by the modified
programs - NetWare Operating System loads all the required libraries
automatically.

SPRINTFX.NLM provides additional commands available from server
console:

  sprintfx file <nlm-path> ; modifies a module
  sprintfx limit <size>    ; sets the maximum size of a result
                           ; of sprintf() and vsprintf() functions
  sprintfx disable         ; any comments needed ?
  sprintfx enable          ; any comments needed ?
  sprintfx status          ; displays various counters and current
                           ; status of SPRINTFX.NLM
  sprintfx reset           ; zeroes all counters and sets default
                           ; limit (200 bytes) of result size

The utility has been tested in NetWare 3.12 and 4.1 environment.

Regards,
Artur Urbanowicz

P.S. SPRINTFX.NLM is dedicated to EwUs, of course!