[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: New xpdf vulnerabilities related to CAN-2004-0888



Martin Pitt <martin@piware.de> wrote:

> Find attached the package interdiffs aganst tetex-bin_2.0.2-23,
> xpdf_3.00-9, and cupsys_1.1.20final+rc1-10. Our version numbers do not
> directly follow fhese Debian versions, but should apply cleanly to
> them.

The patch still uses the constructs critized by Martin Schulze as beeing
dangerous, because it could be optimized away by the compiler:

> - We are using "if (size * sizeof(Foo)/sizeof(Foo) != size)" checks, 

As I said before, I don't know much about C, and I wouldn't trust myself
in adapting the code in the new patch to Joey's way to write it.  At
least I would need some guidance on how to do it. Note also that I'm
going to be busy this afternoon and tomorrow, and most of friday and the
weekend, too.

Anyway, why don't you guys get together and talk about the optimization
problem?

Regards, Frank
-- 
Frank Küster
Inst. f. Biochemie der Univ. Zürich
Debian Developer

Attachment: pgpZt8Nt9nrJt.pgp
Description: PGP signature


Reply to: