Subject: Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

From: Brad House <brad_at_mainstreetsoftworks.com>
Date: Mon, 25 Aug 2008 08:36:24 -0400

> Sorry for the delay,
>
> Verify if what I've just committed is actually what you intended.

I just reviewed the patch you committed:
http://cool.haxx.se/cvs.cgi/curl/ares/ares_process.c.diff?r1=1.65&r2=1.66

It's effect on systems which _do_ support recvfrom() is what I intended,
but it doesn't do anything for systems which do not support recvfrom().

If you are requiring recvfrom() support to compile c-ares, that is fine,
though you can actually remove the memset(&from, 0, sizeof(from)); and
comment above in that case, since my patch used the sreadfrom() call
which on systems without support from recvfrom() would not use the
from and fromlen arguments at all and the memset() was simply used
to detect that.

Finally, you can probably remove the sreadfrom() macro in setup_once.h
if you don't intend on using it, and determining the arg types for
recvfrom() is probably not relevant if you're not using sreadfrom() too,
just a sanity check on if recvfrom() exists at all is all that is
necessary.

-Brad
Received on 2008-08-25