Messages in this thread | | | Subject | Re: Linux Kernel 2.2.13 shooting Solaris ADSM server | From | Matthias Andree <> | Date | 22 Dec 1999 15:23:30 +0100 |
| |
adve@oce.nl (Arjan van de Ven) writes:
> In article <19991222094710.B809EB786C@dungeon.inka.de> you wrote: > > adsm has a buffer overflow: > > "2.1.131" or "2.2.13" or any <= 7 char string as version number is ok. > > "2.1.131a" or "2.1.131aa" or "2.1.131-preX" or whatever kernel with > > 8 or more chars will crash the server. > > > so, if you used some -pre kernel version, this should be it. > > edit Makefile and remove the extraversion. > > Hmm. I think it might be a good idea to provide snprintf next to sprintf... > (Or even remove sprintf to make sure everyone uses the safe version)
It might be a rather good idea if the programmers at IBM check string lengths before letting their software die after client input. Nota bene: Solaris 7 returns up to 257 charactes as release version, Linux 65. Using 8 byte buffers is not a sign of big care.
> If any of the kernel-gods wnat this, I'll make a patch for it in the comming > week.
I'm not sure, it would most probably not solve our problem, since: the client runs on Linux (and invokes uname, getting a 22 character release string), the server software runs on a Solaris machine, the server software dies. Nothing wrong with the Linux kernel, IMNSHO. (Unless, of course, the kernel choked when somebody put a >= 60 character EXTRAVERSION into the /usr/src/linux/Makefile. Never tried so.)
Thanks for your offer anyways.
-- Matthias Andree
Hi! I'm the infamous .signature virus! Copy me into your ~/.signature to help me spread!
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |