This is the mail archive of the glibc-bugs@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug nis/20987] NIS+ unbounded stack allocations


https://sourceware.org/bugzilla/show_bug.cgi?id=20987

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|security-                   |security+

--- Comment #4 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to joseph@codesourcery.com from comment #3)
> Are you confident that these stack allocations can only be triggered by 
> (trusted) data from the network, not by e.g. a lookup of a crafted long 
> user name (something it's plausible could be triggered across a trust 
> boundary)?

Indeed, you are right, the majority of the cases comes from
application-supplied data, not network-supplied data, so it seems this would
indeed be a security fix.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]