Messages in this thread | | | Date | Wed, 11 Jun 2008 10:28:56 +0400 | From | Alexey Dobriyan <> | Subject | Re: Linux 2.6.25.6 |
| |
On Tue, Jun 10, 2008 at 08:06:45PM -0300, Henrique de Moraes Holschuh wrote: > On Tue, 10 Jun 2008, Alexey Dobriyan wrote: > > Person fixing a bug may not realize he fixes security-sensitive bug. > > That is a valid reason, I am pretty sure everyone here (including me) has > been guilty of that one. Which doesn't mean we can't do better to educate > ourselves on the patterns for the most common issues. The "fix for a > null-dereference to anything that has a function pointer in it" is such a > pattern.
Sure.
> > Or simply doesn't care because there are 5 more to fix for today. > > THAT, however, is unacceptable IMO. If one can't be bothered, or one > doesn't have the time (or the skill, whatever) to access the severity of a > fix, he should ask for someone to do that on the commit message. One extra > short sentence at the end of the commit message [asking for that help] is > DEFINATELY not too much to ask.
I just realized crapload of NULL dereferences were fixed in /proc and near last couple of releases.
They were never proposed for any -stable.
And, in retrospective, they wouldn't have been marked as security sensitive.
Do you read OpenBSD commit logs?
| |