From: Evgeny Vereshchagin <evverx@gmail.com>
To: Philippe Antoine <p.antoine@catenacyber.fr>
Cc: "Frank Ch. Eigler" <fche@redhat.com>,
elfutils-devel@sourceware.org,
david korczynski <david@adalogics.com>,
izzeem@google.com
Subject: Re: Fuzzing elfutils
Date: Sat, 22 Oct 2022 13:21:39 +0300 [thread overview]
Message-ID: <CAKKs9uj-qoZLWeqJuR1zHTdeXR7Cj+GCiFh1SavTdH+jDpPhiQ@mail.gmail.com> (raw)
In-Reply-To: <5321B467-3B16-4E7F-A854-98EC8AD6B2C1@catenacyber.fr>
> Could you explain to me why you think it is a false positive ?
As far as I can tell the idea behind that sanitizer is to mostly flag
suspicious attempts to pass file names that
haven't been sanitized in any away and I agree that in some cases
depending on what happens after those files
are opened it can lead to various issues (and for that reason there
are a lot of static analyzers for example complaining
about "tainted" strings, uncontrolled spheres and stuff like that). In
this particular case files go through __libdw_open_file
and their build ids are checked (which makes it kind of hard to read
passwords, tokens and so on and then expose them).
Thanks,
Evgeny Vereshchagin
next prev parent reply other threads:[~2022-10-22 10:21 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <199C1200-40AC-4AD2-89D4-24E172CBA353@catenacyber.fr>
2022-10-21 12:58 ` Philippe Antoine
2022-10-21 13:22 ` Frank Ch. Eigler
2022-10-21 19:57 ` Evgeny Vereshchagin
2022-10-22 9:27 ` Philippe Antoine
2022-10-22 10:21 ` Evgeny Vereshchagin [this message]
2022-10-21 13:33 ` Evgeny Vereshchagin
2014-12-31 11:03 Mark Wielaard
-- strict thread matches above, loose matches on Subject: below --
2014-12-29 3:16 Alexander Cherepanov
2014-12-23 11:42 Mark Wielaard
2014-12-21 22:20 Alexander Cherepanov
2014-12-19 0:13 Mark Wielaard
2014-12-18 18:15 Alexander Cherepanov
2014-12-12 12:08 Mark Wielaard
2014-12-08 9:14 Mark Wielaard
2014-12-08 8:52 Mark Wielaard
2014-12-08 3:06 Alexander Cherepanov
2014-12-08 1:01 Alexander Cherepanov
2014-12-05 8:58 Mark Wielaard
2014-12-04 23:10 Alexander Cherepanov
2014-12-04 16:03 Mark Wielaard
2014-12-04 14:27 Mark Wielaard
2014-12-03 15:16 Alexander Cherepanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKKs9uj-qoZLWeqJuR1zHTdeXR7Cj+GCiFh1SavTdH+jDpPhiQ@mail.gmail.com \
--to=evverx@gmail.com \
--cc=david@adalogics.com \
--cc=elfutils-devel@sourceware.org \
--cc=fche@redhat.com \
--cc=izzeem@google.com \
--cc=p.antoine@catenacyber.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).