From owner-freebsd-vuxml@FreeBSD.ORG  Sun Sep 19 15:33:10 2004
Return-Path: <owner-freebsd-vuxml@FreeBSD.ORG>
Delivered-To: freebsd-vuxml@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5FB6E16A4CE
	for <freebsd-vuxml@freebsd.org>; Sun, 19 Sep 2004 15:33:10 +0000 (GMT)
Received: from gw.celabo.org (gw.celabo.org [208.42.49.153])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 245C143D1F
	for <freebsd-vuxml@freebsd.org>; Sun, 19 Sep 2004 15:33:10 +0000 (GMT)
	(envelope-from nectar@celabo.org)
Received: from localhost (localhost [127.0.0.1])
	by gw.celabo.org (Postfix) with ESMTP
	id 72AD154889; Sun, 19 Sep 2004 10:33:09 -0500 (CDT)
Received: from gw.celabo.org ([127.0.0.1])
 by localhost (hellblazer.celabo.org [127.0.0.1]) (amavisd-new, port 10024)
 with SMTP id 05147-02; Sun, 19 Sep 2004 10:32:58 -0500 (CDT)
Received: from lum.celabo.org (lum.celabo.org [10.0.1.107])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "lum.celabo.org", Issuer "celabo.org CA" (verified OK))
	by gw.celabo.org (Postfix) with ESMTP
	id D568054888; Sun, 19 Sep 2004 10:32:58 -0500 (CDT)
Received: by lum.celabo.org (Postfix, from userid 1001)
	id DC8FD431F57; Sun, 19 Sep 2004 10:32:45 -0500 (CDT)
Date: Sun, 19 Sep 2004 10:32:45 -0500
From: "Jacques A. Vidrine" <nectar@FreeBSD.org>
To: Dan Langille <dan@langille.org>
Message-ID: <20040919153245.GB16616@lum.celabo.org>
Mail-Followup-To: "Jacques A. Vidrine" <nectar@FreeBSD.org>,
	Dan Langille <dan@langille.org>, Mathieu Arnold <mat@mat.cc>,
	freebsd-vuxml@freebsd.org
References: <414C6EA1.25173.34BD6CDE@localhost>
	<414D4589.218.3804EA89@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <414D4589.218.3804EA89@localhost>
X-Url: http://www.celabo.org/
User-Agent: Mutt/1.5.6i
cc: freebsd-vuxml@freebsd.org
cc: Mathieu Arnold <mat@mat.cc>
Subject: Re: confused by ranges
X-BeenThere: freebsd-vuxml@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Documenting security issues in VuXML <freebsd-vuxml.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-vuxml>,
	<mailto:freebsd-vuxml-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-vuxml>
List-Post: <mailto:freebsd-vuxml@freebsd.org>
List-Help: <mailto:freebsd-vuxml-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-vuxml>,
	<mailto:freebsd-vuxml-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Sep 2004 15:33:10 -0000

On Sun, Sep 19, 2004 at 08:38:33AM -0400, Dan Langille wrote:
> > This one is an AND : VER > 2.0 AND VER < 2.0.50_3
> 
> If there are two operators in a range, it is an AND.  The testing
> values always goes before the supplied operator.  Correct?
[...]
> If there are multiple ranges for a package within a vuln, they are
> used to construct an OR.  

When dealing with ranges programatically, one should probably handle
them as one would an interval in any application, e.g.

      struct interval {
              Version    low;
	      bool       low_closed;
	      Version    high;
	      bool       high_closed;
      };

Then comparison is 

      for (int i = 0; i < interval_count; ++i)
              if (interval[i].low  < x ||
		  interval[i].high > x ||
		  (interval[i].low_closed && interval[i].low == x) ||
		  (interval[i].high_closed && interval[i].high == x))
		      /* it is affected */
		      ;

Cheers,
-- 
Jacques A Vidrine / NTT/Verio
nectar@celabo.org / jvidrine@verio.net / nectar@FreeBSD.org