Perry writes: >This bug may make it possible to execute arbitrary code on any >Netscape browser on the net. Ray Clark writes: >As you can see, I just chose an extremely long domain name. I guessed >that the authors of netscape probably thought something like "well, >a buffer size of 256 characters is good enough to hold any domain" Not that it entirely excuses Netscape, but RFC 1034 ("DOMAIN NAMES - CONCEPTS AND FACILITIES") section 3.1 states: To simplify implementations, the total number of octets that represent a domain name (i.e., the sum of all label octets and label lengths) is limited to 255. [end excerpt] They should handle exceptions gracefully. -- Scott Hazen Mueller, Tandem Computers +1 408 285 5762 scott@tandem.com Unix System/Network Administrator, Host-, Post-, News- and Web-Master