Re: Buffer overruns in libltdl/ltdl.c

[Julian Seward]

> > I just looked at rev 1.163 in your CVS repo, and it's definition
> > of realloc is similarly broken (assuming my analysis below is
> > correct).  Are you aware of this?
> 
> I reported this a while ago too -- I sure hope it gets fixed -- it was
> causing all manner of problems here.  Why does ltdl need to implement
> its own memory management anyway?

Who knows.  It kinda looks to me like they originally reimplemented malloc
and free, which worked fine, and later discovered they had to do realloc 
as well, without realising the design flaw.

The KDE fix (yesterday) was to simply nuke realloc and use the default
one.  It breaks the nice user-configurable memory management abstraction,
but I don't think they care about that.  This will ship in KDE 3.0.

J