Re: Code updates

On November 18, 2002 07:56 pm, Alex Kramarov wrote:
> Ok, i if we are really info gzip compression now, maybe this question will
> be finally answered (it was not for the last 2 times i asked about it, so
> this is the last attempt).
>
> The gzip compression code in tux dates back to 1999. the security
> vurnerability in gzip library was discovered this year. Is the code used by
> tux includes any vurnerable code ?

Perhaps no one wants to stick there neck out and say it is ok :-)

I'm not going to say if it is ok or not, but I'll note a couple of things 
after a quick grep or two:

1. a grep of deflate *.c shows nothing but gzip.c
2. nothing seems to use any inflate keyword except gzip.c

If you enable the compression proc entry, my understanding was that no gzip.c 
code was used and that the .gz file (if present) would simply be sent instead 
of the .html file. This makes sense as it would be best to run gzip locally 
to compress all of your html/css/js files before serving them.

If this guess is correct then there would be no vunerability because no gzip 
code would execute. I am beginning to wonder what would happen if gzip.c was 
deleted and you recompiled...


-- 
Schedule your world with ScheduleWorld.com
http://www.ScheduleWorld.com/