GNU bug report logs - #59544
[PATCH] Fixed lib-src/etags.c command execute vulnerability

Previous Next

Full log

View this message in rfc822 format

From: Stefan Kangas <stefankangas <at> gmail.com>
To: lux <lx <at> shellcodes.org>
Cc: 59544 <59544 <at> debbugs.gnu.org>, Eli Zaretskii <eliz <at> gnu.org>
Subject: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability
Date: Fri, 25 Nov 2022 00:56:32 -0800

"lux" <lx <at> shellcodes.org> writes:

>> Hmm, I'm not sure about the hard-coded 512 character line limit here.
>> ISTR that some people use much longer lines than that.
>
> Hi, do you have any suggestions? At present, I think hardcoding 512 is
> enough, thanks :-)

No idea, really.  2^16?  2^20?

But why not allocate it dynamically, getting rid of any such arbitrary
limits?  AFAIU, grep (which we used before) doesn't have such limits, so
I fear that we otherwise risk introducing regressions.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.