Re: Code updates

Ok, i if we are really info gzip compression now, maybe this question will
be finally answered (it was not for the last 2 times i asked about it, so
this is the last attempt).

The gzip compression code in tux dates back to 1999. the security
vurnerability in gzip library was discovered this year. Is the code used by
tux includes any vurnerable code ?

Thank you.
Alex.
----- Original Message -----
From: "Jorge Nerín" <[email protected]>
To: <[email protected]>
Sent: Tuesday, November 19, 2002 1:38 AM
Subject: Re: Code updates


> Now I'm back, I'm very surprised to have 25 new item in the tux box, and
> almost all of them about handling gzip encoding! Oh!, if I had suspected
> this I would post my thongths before ;), I still haven't tested what
> seems to be the solution to the gzip handling, what you says sounds very
> feasible, and after re-reading the source it seems you are rigth, I'm
> pretty sure that in my previous attempt I found what seemed to me a
> reverse use of file sizes, but then I didn't care of vary header, so I
> like your solution the best (and if you also note that mine doesn't even
> seemed to work...).
>
> I will try as soon as possible, thanks to all of you, what a shame to be
> out just in the middle of this furious activity.
>
> Miles Elam wrote:
>
> > This seems suspect to me.  orig_size is the size of the uncompressed
> > item.  size is the compressed size after getting the directory entry
> > from tux_lookup.  I'm am very skeptical that this would fix things.
> >
> > - Miles
> >
> > Jorge Nerín wrote:
> >
> >> I did try a patch, but haven't had a chance to test it because at the
> >> reboot time I "upgraded" froma a pentium 100 to a pentium 133 wich
> >> was damaged and it took me some time to revert it before I hunt it
> >> down to be the cpu, in the mean time I recompiled my kernel various
> >> times and lost that change, it was in handle_gzip_req() and was a
> >> change from:
> >>
> >> req->total_file_len = req->output_len = size;
> >> to
> >> req->total_file_len = req->output_len = orig_size;
> >>
> >> BUT! as I said I havent even tested it, if it works please tell me,
> >> because I'm very thigth in time and was looking for it until I put my
> >> hands on it.
> >
> --
> Jorge Nerín
>
>
>
>
> _______________________________________________
> tux-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/tux-list
>