Re: [Secure-testing-commits] r48631 - in data: . CVE
On Tue, Jan 31, 2017 at 10:14:18PM +0100, Emilio Pozuelo Monfort wrote:
> Hi Balint,
>
> On 31/01/17 21:46, Balint Reczey wrote:
> > Log:
> > wavpack's issues don't affect wheezy
> >
> > The first part of the upstream patch is not needed since the
> > code is very different and not vulnerable.
> > The second part applies, but does not make any difference when
> > trying the exploits. Tested with valgrind on Wheezy.
>
> These issues were found with address sanitizer, so I don't think checking with
> valgrind is enough (it's not the same).
>
> May be worth checking with asan (it should be available in wheezy's llvm 3.1).
I also don't think using valgrind and asan behave the same here. Also it's
obvious that the hunk that fixes the overflow is missing in Wheezy. So
I'd rather stay on the safe side.
Cheers,
-- Guido
Reply to: