From owner-freebsd-hackers@FreeBSD.ORG Tue Jun 24 14:28:31 2014 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2DF96B48; Tue, 24 Jun 2014 14:28:31 +0000 (UTC) Received: from mail-lb0-x22e.google.com (mail-lb0-x22e.google.com [IPv6:2a00:1450:4010:c04::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7C6582FCD; Tue, 24 Jun 2014 14:28:30 +0000 (UTC) Received: by mail-lb0-f174.google.com with SMTP id u10so557402lbd.5 for ; Tue, 24 Jun 2014 07:28:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=NarKZ/rKjGgj4JEqxBoIZ6B9vyhSAFFoX9ioXbL+WZo=; b=YB1Z6qvUflINFzcjbwprXKeFm0OC3ass6Vg/ESk7Fig0Wm5ZZq1dUpLvGxv+huCCNZ vUi6LrTCTdebpYlT+7CtWzTJOt2Em+Vb1/Cy9OVsk4/aGB6WlrVziC+RnOp1Nf8sqxlT KBGW99K58N2FHPmvCgaZerIVRzSX81aMyWCa3zeJGBaNfwmJQ5bms2vIfk8e8lNgQWtn Q8PAPQXvLRwopt1Lorgr+0g0i6bgPY3vVuBQ5FvBRGZmB5XBwKOPLPXNnswDrKpRRXmZ qNJoehcgIunJM75IfEi5fYjVYydr7pQa8tvH1DqFXwmYO/lJ0NOYr3RABolZWVUkccVy 86Ug== X-Received: by 10.152.87.102 with SMTP id w6mr942357laz.52.1403620108378; Tue, 24 Jun 2014 07:28:28 -0700 (PDT) MIME-Version: 1.0 Sender: royce.williams@gmail.com Received: by 10.112.119.211 with HTTP; Tue, 24 Jun 2014 07:28:08 -0700 (PDT) In-Reply-To: <12DA5575-B773-4D28-83BB-5AD1F1C84469@FreeBSD.org> References: <20140622135308.GF1824@pwnie.vrt.sourcefire.com> <53A8FBD7.8000900@gmx.com> <12DA5575-B773-4D28-83BB-5AD1F1C84469@FreeBSD.org> From: Royce Williams Date: Tue, 24 Jun 2014 06:28:08 -0800 X-Google-Sender-Auth: axV6_jq8LMf4s061_u1-njLM4zU Message-ID: Subject: Re: OB1 To: Dimitry Andric Content-Type: text/plain; charset=UTF-8 Cc: dt71@gmx.com, FreeBSD Hackers X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jun 2014 14:28:31 -0000 On Mon, Jun 23, 2014 at 10:49 PM, Dimitry Andric wrote: > On 24 Jun 2014, at 06:17, dt71@gmx.com wrote: >> Speaking of backdoors... >> >> lib/libugidfw/ugidfw.c: >>> if (len < 0 || len > left) >> >> ):< > > Well, it's just another off-by-one, no need for conspiracy theories. :) > > Btw, I'd mailed about this in 2011 already, but it really isn't very > important. The only consumer is ugidfw, and then only to print out the > parsed rules. I'm a relative C newbie. Could someone post what the fix would look like? Royce