Re: Torcs 1.3.7 bundles vulnerable copy of Expat

Hi

Thank you for the information, but your picture is incomplete.

The expat version in TORCS is modified, it uses e.g. snprintf instead of 
printf etc.

So I will gladly fix TORCS volunerabilities in this context, but there 
is not reason to exchange the library, just forget about that is was 
expat, treat it as part of TORCS.

Kind regards

Bernhard

On 20.06.2017 21:38, Sebastian Pipping wrote:
> Hi!
> 
> 
> it came to my attention that Torcs bundles a (very) old vulnerable copy
> of libexpat at src/libs/txml/.
> 
> If you want to keep the bundle for Windows support, please update your
> copy to version 2.2.1 with the latest security fixes.  For Linux distros
> please add a compile switch to use the system-wide installation of Expat
> so that Torcs users are safe as soon as the system installation of Expat
> is updated.  Else every distro will have to unbundle it by themselves,
> which produces diversion from your code, needs forward porting of
> patches for every package update, slows updating down and so on.  So it
> would be awesome to be able to bypass the bundle easily.
> 
> For Expat 2.2.1, a change log with details is available at
> https://github.com/libexpat/libexpat/blob/master/expat/Changes .
> Many thanks in advance!
> 
> Best
> 
> 
> 
> Sebastian
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Torcs-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/torcs-users
> 


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot