Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

2008/8/26, Brad House wrote:

> The compiler will balk on the 'Error Missing_definition_of_macro_sreadfrom' ...
> which obviously would make the change to ares_process.c moot ...

#ifdef'ed out in setup_once.h

> By the way, if it wasn't clear, I'm suggesting that entire block
> from setup_once.h be removed as you've changed my original patch
> such that sreadfrom() is never used. Also, the RECVFROM_TYPE_ARG*
> values are never being used, so either the ares_process.c should
> use them for casting, _or_ the determination of the RECFROM_TYPE_ARG*
> values in acinclude.m4 should go away (as that check can take a
> _long_ time, especially if it's not being used).

Also, if it wasn't clear enough, I was silently avoiding to make a
last minute change in that area. In any case acinclude.m4 has just
been changed to not abort configuration if recvfrom() is not
available.

The results of the check are partially in use, definition of HAVE_RECVFROM.

Brad, do you happen to know a system which doesn't have recvfrom() and
does have recv() ? This is not a rhetorical question I'm really
interested.

-- 
-=[Yang]=-