RE: iSeries buffer overflow immunity?

["Elvis Budimlic" <ebudimlic@xxxxxxxxxxxxxxxxxxxxxxxxx>]

Way I think about it, if I have an error in my code and go over the
allocated buffer size, I can only mess up my job, not any of the other jobs
on the system or any of the OS400 code.  
It would probably manifest itself with "pointer not set" or "terraspace
offset" type error (MCH3601 I believe).

Elvis

-----Original Message-----
Subject: iSeries buffer overflow immunity?

Is the iseries invulnerable to buffer overflows?  I was doing a bit of
googling, and it seems there is a general impression from individual
users that things are OK, but I don't see such information from large
companies or vendors.

I routinely make calls from ILE RPG into the C runtime library, in what
I believe are 'safe' calls.  We have more and more C code converted to
run on the iSeries, such as the Apache HTTP server.

As buffer overflows have been found in things like Apache, it stands to
reason that the iSeries version would have been compiled from the same
source code, and thus have the same coding error.  But, can the coding
error be exploited?  Denial of service?  Privilege escalation?

I'm not aware of any systems that have been compromised in any way, but
I'd like to find some assurances about that.

Thanks.

--
Regards,
Rich

Current Conditions in Des Moines, IA
Broken Clouds
Temp 46.4F
Winds out of the Northeast at 3mph