Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Sep 2011 19:25:42 +0400
From: Solar Designer <>
To: Joerg Sonnenberger <>
Cc: Tavis Ormandy <>,,
Subject: Re: LZW decompression issues

On Thu, Sep 29, 2011 at 02:50:22PM +0200, Joerg Sonnenberger wrote:
> This is not about GNU (g)zip, but the NetBSD/FreeBSD tool of the same
> name. The corresponding NetBSD advisory explicitly lists GNU gzip and
> libarchive as not vulnerable.

Thanks!  My current understanding is that both the NetBSD/FreeBSD gzip
and GNU gzip reuse mid-1980's code from compress, which was in the
public domain.  Those revisions thus could use different licenses (BSD
vs. GPL), and indeed the code is quite different by now.  (Also there's
a lot of code that is not from compress.)

Tomas, Tim - thank you for explaining the "maxbits < 12" check.  It
appears that we don't need it for GNU gzip, and NetBSD/FreeBSD gzip
could want to relax the check too.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.