Subject: Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

From: Brad House <brad_at_mainstreetsoftworks.com>
Date: Tue, 26 Aug 2008 21:32:08 -0400

> Brad, do you happen to know a system which doesn't have recvfrom() and
> does have recv() ? This is not a rhetorical question I'm really
> interested.

I've never run across such a system, that said, I don't typically
use UDP for anything so I may just not have noticed.

I think the bigger concern was that recv() wasn't required, it
actually uses read() on some systems instead (hence the sread()
macro ... that said, just checked, it appears to only be minix
that uses read). Making RECVFROM _required_ I would assume would
break those systems (as if recv() isn't available, I doubt
recvfrom() is ;))

-Brad
Received on 2008-08-27