From owner-freebsd-security Tue Feb 4 13:50:43 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id NAA14788 for security-outgoing; Tue, 4 Feb 1997 13:50:43 -0800 (PST) Received: from austin.polstra.com (austin.polstra.com [206.213.73.10]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA14622; Tue, 4 Feb 1997 13:49:29 -0800 (PST) Received: from austin.polstra.com (jdp@localhost) by austin.polstra.com (8.8.5/8.8.5) with ESMTP id NAA25064; Tue, 4 Feb 1997 13:48:04 -0800 (PST) Message-Id: <199702042148.NAA25064@austin.polstra.com> To: Joe Greco cc: gpalmer@freebsd.org, core@freebsd.org, security@freebsd.org Subject: Re: 2.1.6+++: crt0.c CRITICAL CHANGE In-reply-to: Your message of "Tue, 04 Feb 1997 11:27:39 CST." <199702041727.LAA01352@solaria.sol.net> References: <199702041727.LAA01352@solaria.sol.net> Date: Tue, 04 Feb 1997 13:48:04 -0800 From: John Polstra Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk > In revision 1.21 of crt0.c, ache removed these bits of code, and > several other sources indicate that removal of the locale code is > a sufficient fix. It therefore seems appropriate to move forward > by removing this from crt0.c. Nobody seems to dispute that. But has the actual problem (the buffer overflow) been fixed in the locale code? That needs to be done too. > If anyone is aware of any undesirable side effects The thing to do when you're changing crt0.c is to think very carefully about what will happen with all the combinations: new crt0, old libc.so.x.x old crt0, new libc.so.x.x new crt0, new libc.so.x.x and test all the combinations too. I have been burned by this more than once, when I had thought I had it all figured out. It's a really unpleasant experience to wake up the morning after a commit and find out you've broken make world for a few dozen people. The crt0 changes are particularly insidious, because they can be very hard to back out again. Anyway, I personally don't see such problems in your proposed change. PS - Welcome to the development team! John P. -- John Polstra jdp@polstra.com John D. Polstra & Co., Inc. Seattle, Washington USA "Self-knowledge is always bad news." -- John Barth