Re: SLFS

Archaic wrote:
> On Thu, Dec 25, 2003 at 09:13:04AM +0000, Spencer Collyer wrote:
> 
>>While waiting for the grilf to turn up this morning, I've just redone the
>>search using a better search string. Search command and result file (now
>>also bzip2'ed, and renamed unsafe2.out.bz2) are available at
>>http://www.lasermount.uklinux.net/lfs-unsafe/ as before.
> 
> 
> That shows that at least one of those functions occurs in every single
> package LFS installs. I don't think patching every single one is going
> to be an option, otherwise one would think that some of them would have
> been fixed by the maintainers by now. :(
> 

Many so-called unsafe functions are not unsafe in the context they are 
used. If, for example, the length of the string to copy has already been
determined not to exceed the size of the allocated buffer then strcpy() 
is perfectly fine and is more efficient than strncpy(). Patching all 
occurrences would actually be deleterious.

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page