stan zasobów Ra (Re: Dzisiejsze ISO znowu zjebane)

[Jakub Bogusz]

On Mon, Apr 08, 2002 at 12:29:44AM +0200, Arkadiusz Miskiewicz wrote:
> Jakub Bogusz <qboosh w pld.org.pl> writes:
> 
> > Poza tym sprawa security - IIRC nadal do poprawienia są:
> > - listar
> > - freeamp(?)
> freeamp też
> 
> > - co z gzipem? misiek wspominał, że do poprawki, ale w changelogu 1.3.3
> >   nie widzę nic na ten temat?
> www.gzip.org
> 
> Important security patch gzip 1.2.4 may crash when an input file name
> is too long (over 1020 characters). The buffer overflow may be
> exploited if gzip is run by a server such as an ftp server. Some ftp
> servers allow compression and decompression on the fly and are thus
> vulnerable. See technical details here. This patch to gzip 1.2.4 fixes
> the problem. The beta version 1.3.3 already includes a sufficient
> patch; use this version if you have to handle files larger than 2
> GB. A new official version of gzip will be released soon.

Z tego co widzę, to w 1.3 jest tak samo jak w 1.3.3:

    if (sizeof ifname - 1 <= strlen (iname))
        goto name_too_long;

    strcpy(ifname, iname);

więc zostaje freeamp i listar.


-- 
Jakub Bogusz