[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [bug-gettext] intl: Proof against invalid offset/length

From: Daiki Ueno
Subject: Re: [bug-gettext] intl: Proof against invalid offset/length
Date: Fri, 20 Mar 2015 10:06:22 +0900
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux)

"Carlos O'Donell" <address@hidden> writes:

> On 03/13/2015 10:29 AM, Florian Weimer wrote:
>> On 03/12/2015 02:04 AM, Bruno Haible wrote:
>>> But these arguments don't consider the LANGUAGE variable. The original
>>> intent of LANGUAGE was that it contains colon-separated language or locale
>>> identifiers. But in fact, you can specify relative files names that start
>>> with "../", and thus you can make the _nl_load_domain function in glibc
>>> access files anywhere in the file system.
>> Yes, this is bug 17142.
> In my opinion we need to restrict LANGUAGE just like we restricted all
> other the other variables in CVE-2014-0475.

I agree.  Now that intl/ is almost[1] synchronized with gettext, what's
blocking this?  I'm happy to include the patch in the upcoming gettext
release so non-glibc consumers also benefit from it.

[1]  except a minor adjustment for non-glibc systems:
     and absolute pathname handling, which I guess could be reverted because
     of not much use:

Daiki Ueno

reply via email to

[Prev in Thread] Current Thread [Next in Thread]