This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] vfprint: validate nargs and argument-based offsets
- From: "Carlos O'Donell" <carlos at systemhalted dot org>
- To: Kees Cook <kees at outflux dot net>
- Cc: Tomas Hoger <thoger at redhat dot com>, Andreas Jaeger <aj at suse dot com>, "Ryan S. Arnold" <ryan dot arnold at gmail dot com>, libc-alpha at sourceware dot org, Paul Eggert <eggert at cs dot ucla dot edu>, Roland McGrath <roland at hack dot frob dot com>, Andreas Schwab <schwab at linux-m68k dot org>
- Date: Mon, 5 Mar 2012 13:20:32 -0500
- Subject: Re: [PATCH] vfprint: validate nargs and argument-based offsets
- Authentication-results: mr.google.com; spf=pass (google.com: domain of patofiero@gmail.com designates 10.236.190.5 as permitted sender) smtp.mail=patofiero@gmail.com; dkim=pass header.i=patofiero@gmail.com
- References: <20120302185346.GE3990@outflux.net><20120305180923.74a20a8f@redhat.com><20120305180608.GR3990@outflux.net>
On Mon, Mar 5, 2012 at 1:06 PM, Kees Cook <kees@outflux.net> wrote:
>> A commenter in Red Hat bugzilla proposed different fix:
>>
>> https://bugzilla.redhat.com/show_bug.cgi?id=794766#c8
>>
>> ? The easiest fix would have been to restrict "nargs" to NL_ARGMAX.
>>
>> ? http://www.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html#tag_13_23_03_07
>>
>> which has the benefit of avoiding possibly large heap allocation in the
>> bad case. ?Kees, have you considered such approach?
>
> I have no problem with this. I opted against it originally since it seemed
> like a needless limit to nargs when other options for handling it existed.
>
> That said, it's a much simpler fix. :) Would anyone else prefer it over
> the current fix?
We should avoid arbitrary limits.
Your fix has a high QoI and solves the problem.
Cheers,
Carlos.