[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 4 Aug 2011 22:57:20 +0800
From: Daniel Veillard <veillard@...hat.com>
To: Billy Rios <billy.rios@...il.com>
Cc: Marcus Meissner <meissner@...e.de>,
OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: libxml security fix from apple ... any information?
On Thu, Jul 28, 2011 at 09:59:22PM -0700, Billy Rios wrote:
> The crash was indeed in libxml2, but I could not get the bug to repro in
> Linux. We took the crash file and fuzzed a bit more on Linux, but no
> crashes were observed.
Just wondering, are you by chance changing the libxml2 buffer allocation
strategy in the application code (function xmlSetBufferAllocationScheme())
and associated global variable (I know I know ...) xmlBufferAllocScheme.
That may explain if you switched to an exact allocation policy why
you hit the buffer overrun while it usually doesn't show up,
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel@...llard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
