[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Jun 2011 14:05:17 +0100
From: Djalal Harouni <tixxdz@...ndz.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: crypt_blowfish 8-bit character
mishandling
On Mon, Jun 20, 2011 at 09:01:11AM +0400, Solar Designer wrote:
> Oh, also some builds of crypt_blowfish (and of affected systems/apps)
> for PowerPC are probably unaffected, because char is typically unsigned
> there (unless overridden in compiler flags for compatibility with more
> typical systems).
Just to add that on some (perhaps all) ARM plateforms char is by
default: "unsigned" (unless you compile with -fsigned-char as you have
noted).
This is an old link that expose some problems when you just use 'char var'
on ARM (perhaps not only on ARM):
http://www.arm.linux.org.uk/docs/faqs/signedchar.php
--
tixxdz
http://opendz.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
