Date: Sat, 27 Sep 2014 12:39:57 -0700 From: Michal Zalewski <lcamtuf@...edump.cx> To: Chester Ramey <chet.ramey@...e.edu> Cc: Tavis Ormandy <taviso@...xchg8b.com>, Florian Weimer <fw@...eb.enyo.de>, Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com Subject: Re: CVE-2014-6271: remote code execution through bash > STD::what::does::this::do We ran into this problem with the original patch at Google, but TBH, we've just bitten the bullet. I'm not sure how hard we should try to accommodate outliers like this specifically for functions - as far as I can tell, you can't really get away with meaningfully using colons in variable names, right? But if you just want to minimize breakage without getting into existential discussions, wouldn't wihtelisting : and perhaps periods and - going out on a limb - brackets be good enough? /mz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.