bengottlieb/Twitter-OAuth-iPhone — Issue #93: Unsafe use of strstr() on non-null-terminated string
Author: newacct
Created: 2011-10-20 03:54:20+00:00
State: open

In [SA_OAuthTwitterController webView:shouldStartLoadWithRequest:navigationType:], you get the bytes from an NSData using `[data bytes]`, and then in the next line you proceed to use strstr() on it. However, strstr() requires that its arguments are null-terminated, and the bytes you get from [NSData bytes] is not null-terminated. If the substring is not found, it will run off the end of the buffer.