Subject: Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

Re: [PATCH] Security: Validate response address, possibly related to CVE-2008-1447

From: Brad House <brad_at_mainstreetsoftworks.com>
Date: Wed, 20 Aug 2008 22:53:09 -0400

> An initial effort for a proper 'sreadfrom' macro was done. it outcomed
> that there is much more work involved than I initially estimated (HPUX
> main culprit). And as I already had something 'more time consuming'
> that should be completed before next libcurl release release (the
> curl_off_t stuff) I simply left the sreadfrom macro definition in the
> source tree 'as is' but didn't actually use it in the source tree.
>
> So, sorry for not getting back to you on this.
>
> Could you simply use recvfrom in your patch and get rid of the sreadfrom usage ?

Sure, I was just trying to stay consistent with the current
implementation and assumed it probably wouldn't be ok to
embed #ifdefs in the function itself, but it's a trivial
change to make.

My HP-UX box is in storage so I can't test on that right
now to see what the issue is there, but I know HP-UX
does support recvfrom() though unless you specify
_XOPEN_SOURCE_EXTENDED, the argument types are slightly
non-standard.

The last patch I sent did modify the sreadfrom() macro to
point to the standard sread() in the event that recvfrom()
didn't exist.

-Brad
Received on 2008-08-21