{"action":"created","issue":{"url":"https://api.github.com/repos/mapserver/mapserver/issues/4393","labels_url":"https://api.github.com/repos/mapserver/mapserver/issues/4393/labels{/name}","comments_url":"https://api.github.com/repos/mapserver/mapserver/issues/4393/comments","events_url":"https://api.github.com/repos/mapserver/mapserver/issues/4393/events","html_url":"https://github.com/mapserver/mapserver/issues/4393","id":5661146,"number":4393,"title":"Buffer overflow in msOWSParseRequestMetadata","user":{"login":"constantinius","id":1109799,"avatar_url":"https://avatars.githubusercontent.com/u/1109799?v=3","gravatar_id":"","url":"https://api.github.com/users/constantinius","html_url":"https://github.com/constantinius","followers_url":"https://api.github.com/users/constantinius/followers","following_url":"https://api.github.com/users/constantinius/following{/other_user}","gists_url":"https://api.github.com/users/constantinius/gists{/gist_id}","starred_url":"https://api.github.com/users/constantinius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/constantinius/subscriptions","organizations_url":"https://api.github.com/users/constantinius/orgs","repos_url":"https://api.github.com/users/constantinius/repos","events_url":"https://api.github.com/users/constantinius/events{/privacy}","received_events_url":"https://api.github.com/users/constantinius/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mapserver/mapserver/labels/WFS%20Server","name":"WFS Server","color":"d7e102"},{"url":"https://api.github.com/repos/mapserver/mapserver/labels/WMS%20Server","name":"WMS Server","color":"d7e102"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2012-07-17T11:01:57Z","updated_at":"2015-11-11T15:40:12Z","closed_at":null,"body":"Since version 6 of Mapserver a bug exists in `msOWSParseRequestMetadata`, resulting in a buffer overflow/stack smashing on 32 bit machines (the error may also be applicable for other architectures, but did not yet show).\n\nThe cause is the `char requestBuffer[32];` where data is written over the boundaries of the array in some cases.\n\nExample MapFile: http://pastebin.com/pTvyS4q6 \nResult: http://pastebin.com/Xp15Pkwd"},"comment":{"url":"https://api.github.com/repos/mapserver/mapserver/issues/comments/155820451","html_url":"https://github.com/mapserver/mapserver/issues/4393#issuecomment-155820451","issue_url":"https://api.github.com/repos/mapserver/mapserver/issues/4393","id":155820451,"user":{"login":"jratike80","id":1751612,"avatar_url":"https://avatars.githubusercontent.com/u/1751612?v=3","gravatar_id":"","url":"https://api.github.com/users/jratike80","html_url":"https://github.com/jratike80","followers_url":"https://api.github.com/users/jratike80/followers","following_url":"https://api.github.com/users/jratike80/following{/other_user}","gists_url":"https://api.github.com/users/jratike80/gists{/gist_id}","starred_url":"https://api.github.com/users/jratike80/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jratike80/subscriptions","organizations_url":"https://api.github.com/users/jratike80/orgs","repos_url":"https://api.github.com/users/jratike80/repos","events_url":"https://api.github.com/users/jratike80/events{/privacy}","received_events_url":"https://api.github.com/users/jratike80/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T15:40:12Z","updated_at":"2015-11-11T15:40:12Z","body":"The place to insert the patch is perhaps https://github.com/mapserver/mapserver/blob/branch-7-0/mapows.c#L743. I am not sure if this part of code is still the same, the history is https://github.com/mapserver/mapserver/commits/branch-7-0/mapows.c\r\n"}}