From owner-freebsd-security@FreeBSD.ORG Wed Mar 26 18:25:58 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6AC6837B404; Wed, 26 Mar 2003 18:25:58 -0800 (PST) Received: from mta01-svc.ntlworld.com (mta01-svc.ntlworld.com [62.253.162.41]) by mx1.FreeBSD.org (Postfix) with ESMTP id E1B0E43F3F; Wed, 26 Mar 2003 18:25:56 -0800 (PST) (envelope-from colin.percival@wadham.ox.ac.uk) Received: from piii600.wadham.ox.ac.uk ([81.103.196.4]) by mta01-svc.ntlworld.comESMTP <20030327022555.FLW6166.mta01-svc.ntlworld.com@piii600.wadham.ox.ac.uk>; Thu, 27 Mar 2003 02:25:55 +0000 Message-Id: <5.0.2.1.1.20030327021835.01e005c8@popserver.sfu.ca> X-Sender: cperciva@popserver.sfu.ca X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Thu, 27 Mar 2003 02:25:53 +0000 To: "Jeremy C. Reed" , "Jacques A. Vidrine" From: Colin Percival In-Reply-To: References: <20030326140204.GC33671@madman.celabo.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Spam-Status: No, hits=-25.4 required=5.0 tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, RCVD_IN_UNCONFIRMED_DSBL,REFERENCES,REPLY_WITH_QUOTES autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) cc: freebsd-security@freebsd.org Subject: Re: what actually uses xdr_mem.c? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2003 02:26:01 -0000 At 08:18 26/03/2003 -0800, Jeremy C. Reed wrote: >On Wed, 26 Mar 2003, Jacques A. Vidrine wrote: > > Have a look at Colin Percival's binary updates stuff. He believes he > > has overcome these issues. > >I will look at it closer. (But I was told off-list that it didn't. >Nevertheless, it would be nice to find a way to automate this.) To clarify: I'm not sure if my code worked properly here. It certainly hasn't missed any files, but it might have introduced false positives -- I was surprised by the number of files it identified as having changed. I'm currently looking at this in more detail to determine if in fact these are false positives. Colin Percival PS. Can I convince anyone to look at ports/50202?