RE: Possible security flaw in Insight

[Ben Hutchings <ben@decadentplace.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1396 bytes --]

[I'm not subscribed to the mailing list, so please continue to cc
replies to me.]

Dave Korn wrote:
> Ben Hutchings wrote:
> > This security advisory explains a bug in some versions of Tcl, which
> > may affect Insight.
> > 
> > Ben.
> > 
> > readdir_r considered harmful
> > ============================
> 
> 
>   Well, readdir_r is used in tcl/unix/tclUnixThrd.c as follows:
> 
> --------------------------------snip--------------------------------
> typedef struct ThreadSpecificData {
>     char	    	nabuf[16];
>     struct tm   	gtbuf;
>     struct tm   	ltbuf;
>     struct {
> 	Tcl_DirEntry ent;
> 	char name[PATH_MAX+1];
>     } rdbuf;
> } ThreadSpecificData;

In some versions of Tcl (8.4.2 to 8.5a2 inclusive), the dimension of the
name field is MAXNAMLEN+1, not PATH_MAX+1.

<snip>
>   I'm with Zaraza (sp?) on this one.  What's wrong with statically sizing it
> to NAME_MAX+1, in accordance with the demands of the posix spec?
<snip>

NAME_MAX isn't required to be defined (and MAXNAMLEN isn't even
mentioned by POSIX, though it is equivalent on many systems).  GNU/Hurd
doesn't define it, for example, because there is no practical limit on
name lengths there.

Ben.

-- 
Ben Hutchings
When you say `I wrote a program that crashed Windows', people just stare ...
and say `Hey, I got those with the system, *for free*'. - Linus Torvalds

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]