[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug #15300] not paranoid enough about device name

From: Samuel Thibault
Subject: [bug #15300] not paranoid enough about device name
Date: Mon, 26 Dec 2005 23:48:32 +0100
User-agent: w3m/0.5.1


                 Summary: not paranoid enough about device name
                 Project: The GNU Hurd
            Submitted by: sthibaul
            Submitted on: lun 26.12.2005 à 23:48
                Category: GNU Mach
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
         Reproducibility: None
              Size (loc): None
                  Effort: 0.00



>From http://bugs.debian.org/113732

From: Marcus Brinkmann <Marcus.Brinkmann@ruhr-uni-bochum.de>
To: submit@bugs.debian.org
Subject: not paranoid enough about device name
Date: Fri, 28 Sep 2001 02:09:08 +0200

Package: gnumach

gnumach device_open is not paranoid enough about the device name.  I haven't
tried it, but I think that having 128 non-digits with no trailing zero will
make gnumach run past the buffer in dev_name_lookup.

Maybe not worth fixing for gnumach (esp as opening a device requires the
device master port anyway).  But it reminds me of the broader issue of the
necessity to audit the code, esp at the borders caused by user supplied



Reply to this item at:


  Message posté via/par Savannah

reply via email to

[Prev in Thread] Current Thread [Next in Thread]