Re: Backport of the integer overflow in the brk system call
On Wed, 3 Dec 2003 10:20, Andrew Pollock <debian-lists@andrew.net.au> wrote:
> What bugs the hell out of me is that people with nothing better to do with
> their time can sit on the lkml and watch what's getting fixed, and put more
> analysis into individual fixes than the kernel maintainers themselves can,
> and cook up an exploit for what all and sundry previously believed to be
> reasonably benign.
>
> I love the bazaar development model, but I see this as a serious flaw with
> it...
Of course someone could look at the MS fixes and do some decompilation for a
similar result. Sure it would be more difficult to analyse the assembler
code produced from decompilation than to analyse C source, but OTOH there is
no possibility for other people to try to fix bugs either.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
Reply to: