GNU bug report logs - #59544
[PATCH] Fixed lib-src/etags.c command execute vulnerability

Previous Next

Full log

View this message in rfc822 format

From: Eli Zaretskii <eliz <at> gnu.org>
To: Stefan Kangas <stefankangas <at> gmail.com>
Cc: 59544 <at> debbugs.gnu.org, lx <at> shellcodes.org
Subject: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability
Date: Fri, 25 Nov 2022 14:19:30 +0200

> From: Stefan Kangas <stefankangas <at> gmail.com>
> Date: Fri, 25 Nov 2022 00:56:32 -0800
> Cc: Eli Zaretskii <eliz <at> gnu.org>, 59544 <59544 <at> debbugs.gnu.org>
> 
> "lux" <lx <at> shellcodes.org> writes:
> 
> >> Hmm, I'm not sure about the hard-coded 512 character line limit here.
> >> ISTR that some people use much longer lines than that.
> >
> > Hi, do you have any suggestions? At present, I think hardcoding 512 is
> > enough, thanks :-)
> 
> No idea, really.  2^16?  2^20?
> 
> But why not allocate it dynamically, getting rid of any such arbitrary
> limits?  AFAIU, grep (which we used before) doesn't have such limits, so
> I fear that we otherwise risk introducing regressions.

Yes, reallocating dynamically as needed would be best.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.