[PATCH][BZ #16072] Fix stack overflow due to large AF_INET6 requests

[Mike Frysinger]

On Friday 25 October 2013 00:41:44 Siddhesh Poyarekar wrote:
> On Thu, Oct 24, 2013 at 05:51:35PM -0400, Frank Ch. Eigler wrote:
> > But the CVE's were issued precisely because sometimes attackers have
> > control of a DNS zone.  But the DoS worry (that the act of attempting
> > to allocate excessive memory harms the system) seems quite remote in
> > this case.
> 
> Right, thanks for pointing that out.

for other APIs (like regex), iiuc, our position has been that any sane service 
which may be accessed remotely is supposed to be using sane ulimit/etc... to 
limit resource over taxing.  otherwise, you run into things like:
	- ftp server allows regex w/ls commands
	- ftp server uses C library's regex API
	- resource exhaustion due to use of pathological regex (back references 
and lots of sub groups and such)

should we codify that position somewhere ?
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20131223/bb281915/attachment.sig>