From owner-freebsd-security Sun May 5 15:36:29 2002 Delivered-To: freebsd-security@freebsd.org Received: from oxmail.ox.ac.uk (oxmail1.ox.ac.uk [129.67.1.2]) by hub.freebsd.org (Postfix) with ESMTP id 8E14C37B400 for ; Sun, 5 May 2002 15:36:25 -0700 (PDT) Received: from heraldgate2.oucs.ox.ac.uk ([163.1.2.50] helo=frontend2.herald.ox.ac.uk ident=exim) by oxmail.ox.ac.uk with esmtp (Exim 3.36 #1) id 174Uc4-0000Bs-01; Sun, 05 May 2002 23:36:16 +0100 Received: from dhcp1125.wadham.ox.ac.uk ([163.1.161.125] helo=piii600.wadham.ox.ac.uk) by frontend2.herald.ox.ac.uk with esmtp (Exim 3.32 #1) id 174Ubu-0003uH-00; Sun, 05 May 2002 23:36:06 +0100 X-Info-RBL1: ox.ac.uk filters email against various lists. X-Info-RBL2: If your replies bounce, try sending them to cperciva@sfu.ca Message-Id: <5.0.2.1.1.20020505224651.00afbd78@popserver.sfu.ca> X-Sender: cperciva@popserver.sfu.ca X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Sun, 05 May 2002 23:27:49 +0100 To: ReDeeMeR , From: Colin Percival Subject: Re: Buffer overflow in /usr/games/strfile In-Reply-To: <20020505213314.8762.qmail@uwdvg007.cms.usa.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Given that this is not a security issue -- as you point out, "no extra privileges can be gained" -- this is rather off-topic for -security; nevertheless, it is less so than discussions of mailing list sender restrictions, so I'll go ahead and respond. If you look at http://www.freebsd.org/cgi/cvsweb.cgi/src/games/fortune/strfile/strfile.c you'll see the CVS log for the file in question. At present it shows that the latest change was made six weeks ago; your change has not been incorporated. This isn't really surprising, since FreeBSD is run by volunteers, and unless they are either provided with a patch or convinced that an issue is vitally important, nothing is likely to happen. You've described a problem, worked out how to fix it, described how to fix it... but you haven't completed the final two steps: Generating a patch, and submitting it as part of a Problem Report. So, here's what you should do: 1. Generate a patch for src/games/fortune/strfile/strfile.c. This means running `diff -c` on the original file and your fixed version. 2. Use send-pr to generate a problem report. Make sure the synopsis field starts with [PATCH], and run send-pr with the -a option to include your patch file. 3. Wait until a committer notices your pr and incorporates your patch. I'd also suggest that you read http://www.freebsd.org/doc/en_US.ISO8859-1/articles/problem-reports/article.html and http://www.freebsd.org/doc/en_US.ISO8859-1/articles/contributing/contrib-how.html Colin Percival To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message