Re: [bug-gettext] intl: Proof against invalid offset/length

[Carlos O'Donell]

On 03/13/2015 10:29 AM, Florian Weimer wrote:
> On 03/12/2015 02:04 AM, Bruno Haible wrote:
> 
>> But these arguments don't consider the LANGUAGE variable. The original
>> intent of LANGUAGE was that it contains colon-separated language or locale
>> identifiers. But in fact, you can specify relative files names that start
>> with "../", and thus you can make the _nl_load_domain function in glibc
>> access files anywhere in the file system.
> 
> Yes, this is bug 17142.

In my opinion we need to restrict LANGUAGE just like we restricted all
other the other variables in CVE-2014-0475.

Cheers,
Carlos.