bugs.txt

#
# [file:#lines]
# desc
#

[zookd.c:65]
function process_client has local variable: 'reqpath', contains HTTP Request URL, let this buffer overflow, cover return address, example in exploit-2a.py

(function return address) - (reqpath's start address) = 0x814


[http.c:125]
function http_request_headers has local variable: 'value', contains HTTP header value, let this buffer overflow, can cover function local variable 'colon', example in exploit-2b.py. But variable 'colon' will be reinit before used everytime, so this exploit is useless.

(colon address) - (value's start address) = 0x200