[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Sep 2011 19:25:42 +0400
From: Solar Designer <solar@...nwall.com>
To: Joerg Sonnenberger <joerg@...tannica.bec.de>
Cc: Tavis Ormandy <taviso@...xchg8b.com>, oss-security@...ts.openwall.com,
joerg@...bsd.org
Subject: Re: LZW decompression issues
On Thu, Sep 29, 2011 at 02:50:22PM +0200, Joerg Sonnenberger wrote:
> This is not about GNU (g)zip, but the NetBSD/FreeBSD tool of the same
> name. The corresponding NetBSD advisory explicitly lists GNU gzip and
> libarchive as not vulnerable.
Thanks! My current understanding is that both the NetBSD/FreeBSD gzip
and GNU gzip reuse mid-1980's code from compress, which was in the
public domain. Those revisions thus could use different licenses (BSD
vs. GPL), and indeed the code is quite different by now. (Also there's
a lot of code that is not from compress.)
Tomas, Tim - thank you for explaining the "maxbits < 12" check. It
appears that we don't need it for GNU gzip, and NetBSD/FreeBSD gzip
could want to relax the check too.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
