Re: iSeries buffer overflow immunity?

[Barbara Morris <bmorris@xxxxxxxxxx>]

Rich Duzenbury wrote:
> 
> ...  My experiments
> with RPG bear this out - I wasn't been able to craft a buffer overflow
> using a variable (which I expected), nor a variable pointed at by a
> pointer (which I did not expect).
> 

You can easily get a buffer overflow in RPG using a pointer - declare a
5A based field and set the basing pointer to the address of something 4
bytes long, and write to the 5A field - it will write to the 4 bytes you
know about and then one byte that you don't know about.

It might not always cause a direct crash at the time of overflowing the
buffer.  You would only get a direct crash if you tried to reference
past the end of a physical segment.  But you can easily trash storage
that someone else (even your program) might be using, and cause
unspecified bad things to happen.

Our old friend, "parameter mismatch" is a great example of buffer
overflow.