[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHmME9rNUXu16RD_fYYDfJa74F8M38tSjk+OU8ugEk8Zi4WKug@mail.gmail.com>
Date: Wed, 17 May 2017 13:41:32 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Marc Lehmann <schmorp@...morp.de>, oss-security <oss-security@...ts.openwall.com>
Cc: rxvt-unicode@...morp.de, "jer@...too.org" <jer@...too.org>
Subject: Defense in depth patch for rxvt-unicode
Hello list,
This email thread concerns my request to Marc to include the attached
patch inside rxvt-unicode upstream. My own downstream -- Gentoo's
jer@, also CCd -- won't include the patch until the agreement of
upstream. Thus, it's important we come to a good conclusion.
On Wed, May 17, 2017 at 3:17 AM, Marc Lehmann <schmorp@...morp.de> wrote:
> On Fri, May 12, 2017 at 02:18:29PM +0200, "Jason A. Donenfeld" <zx2c4@...too.org> wrote:
>> I realize I might have used the wrong email address, so please see the
>> thread below.
>
> You used the right address, but since I was quite busy, and your mail
> contained nothing but a patch that might break valid uses without any
> explanation of what it might be useful for, I didn't immediately know what
> to reply and it fell through the cracks.
Hi Marc,
This patch was part of a larger discussion on which you were CCd from
distros. It seems possible that either those messages didn't make it
to you, or you didn't have time to read them.
In any case, the attached patch would be a useful defense in depth
measure to prevent future integer overflow bugs, such as the one that
was recently found in rxvt. Briefly looking though the code, it seems
like there is a considerable amount of unchecked integer arithmetic,
often passing between several functions in several files. Short of
somehow auditing every arithmetic call path, a considerable
undertaking, Alexander and I would recommend simply limiting the range
of input from users.
As Alexander wrote in a recent email to you, the general opinion of
this list is that terminal emulators should not support the most
dangerous uses of escape sequences, even if they're technically valid.
The attached patch falls into that category. You seem to have made the
argument that the patch "might break valid uses". I've now provided to
you a bit of the backstory and recent basis which motivates this
patch. If this is compelling, I'd rest well knowing it's accepted
upstream. If this is not compelling, could you indicate to the list
why "might break valid uses" outweighs the potential security
mitigations?
Regards,
Jason
View attachment "rxvt-unicode-defense-in-depth-fix.patch" of type "text/x-patch" (447 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
