[ping5][PATCH][BZ15362] Fix fwrite() reading beyond end of buffer in error path

[Siddhesh Poyarekar]

On Sat, Oct 12, 2013 at 07:49:19AM +1000, Allan McRae wrote:
> On 12/10/13 03:07, Siddhesh Poyarekar wrote:
> > On 11 October 2013 19:48, Andreas Schwab <schwab@linux-m68k.org> wrote:
> >> Just go ahead, nobody had objections.
> > 
> > Thanks,  I've pushed this now.
> > 
> 
> Does the potential information disclosure in this bug make it CVE worthy?
> 

I'm not sure.  It does allow reading beyond bounds of the input buffer
and possibly relaying that information into a file.  However, this
would require causing the filesystem to return an error somehow and
that seems difficult.  One could technically fill up the filesystem
and induce an error, but aren't quotas a defacto thing nowadays?  The
other possibility may be bugs in the filesystem that may result in
spurious error return.

Siddhesh