Re: Fixing a security hole in mount table.

2003-09-10 Thread Corinna Vinschen
On Tue, Sep 09, 2003 at 10:05:09AM -0400, Pierre A. Humblet wrote: > Corinna Vinschen wrote: > > > > On Mon, Sep 08, 2003 at 09:11:34PM -0400, Christopher Faylor wrote: > > > On Mon, Sep 08, 2003 at 08:46:06PM -0400, Pierre A. Humblet wrote: > > > >This is the first in a series of patches fixing s

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Corinna Vinschen
On Tue, Sep 09, 2003 at 11:54:26PM -0400, Pierre A. Humblet wrote: > 2003-09-10 Pierre Humblet <[EMAIL PROTECTED]> > > * shared_info.h (shared_info::initialize): Remove argument. > * cygheap.h (cygheap_user::init): New declaration. > * uinfo.cc (cygheap_user::init): New. >

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Pierre A. Humblet
Corinna Vinschen wrote: > > Looks good to me, except for: > > > - char name[UNLEN + 1] = ""; > > + char name[UNLEN > 127 ? UNLEN + 1 : 128] = ""; > > Huh? Why that? UNLEN is defined as 256 in lmcons.h so I don't understand > the reasoning behind that complexity. > Just being paranoid. "name

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Corinna Vinschen
On Wed, Sep 10, 2003 at 09:36:05AM -0400, Pierre A. Humblet wrote: > Corinna Vinschen wrote: > > > > Looks good to me, except for: > > > > > - char name[UNLEN + 1] = ""; > > > + char name[UNLEN > 127 ? UNLEN + 1 : 128] = ""; > > > > Huh? Why that? UNLEN is defined as 256 in lmcons.h so I don

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Pierre A. Humblet
Corinna Vinschen wrote: > > On Wed, Sep 10, 2003 at 09:36:05AM -0400, Pierre A. Humblet wrote: > > Corinna Vinschen wrote: > > > > > > Looks good to me, except for: > > > > > > > - char name[UNLEN + 1] = ""; > > > > + char name[UNLEN > 127 ? UNLEN + 1 : 128] = ""; > > > > > > Huh? Why that? UN

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Corinna Vinschen
On Wed, Sep 10, 2003 at 12:50:34PM -0400, Pierre A. Humblet wrote: > Corinna Vinschen wrote: > > > > On Wed, Sep 10, 2003 at 09:36:05AM -0400, Pierre A. Humblet wrote: > > > Corinna Vinschen wrote: > > > > > > > > Looks good to me, except for: > > > > > > > > > - char name[UNLEN + 1] = ""; > > >

Re: Part 2 of Fixing a security hole in mount table.

2003-09-10 Thread Christopher Faylor
On Wed, Sep 10, 2003 at 09:15:51PM +0200, Corinna Vinschen wrote: >On Wed, Sep 10, 2003 at 12:50:34PM -0400, Pierre A. Humblet wrote: >> OK, do you want to change that back and check it in? >> Otherwise I will do it tonight. > >Just do it tonight. I'll check it in now. I'm generating a snapshot

Fixing a security hole in pinfo.

2003-09-10 Thread Pierre A. Humblet
Each Cygwin process publishes information about itself (e.g. pid, ppid, uid, gid, ...) in a _pinfo file mapping. Currently Everyone has write access to the _pinfo file mapping. Thus Everyone can change a process uid and gid. By changing its uid and gid, one can trick a daemon into logging in a

Re: Fixing a security hole in pinfo.

2003-09-10 Thread Christopher Faylor
On Thu, Sep 11, 2003 at 12:05:42AM -0400, Pierre A. Humblet wrote: >The flag PID_MAP_RW is added in the few pinfo constructors >that need to be write into _pinfo if it exists. >[snip] >diff -u -p -r1.166 exceptions.cc >--- exceptions.cc 10 Sep 2003 17:26:12 - 1.166 >+++ exceptions.cc

Re: Fixing a security hole in pinfo.

2003-09-10 Thread Pierre A. Humblet
At 12:15 AM 9/11/2003 -0400, you wrote: >On Thu, Sep 11, 2003 at 12:05:42AM -0400, Pierre A. Humblet wrote: >>The flag PID_MAP_RW is added in the few pinfo constructors >>that need to be write into _pinfo if it exists. >>[snip] >>diff -u -p -r1.166 exceptions.cc >>--- exceptions.cc 10 Sep 2003

setfragment patch for sound device

2003-09-10 Thread peter garrone
The following patch to the /dev/dsp sound device does the following: - implements SNDCTL_DSP_SETFRAGMENT, allowing smaller sound buffers to be used. - trivially implements SNDCTL_DSP_CHANNELS. - opens and closes the class device upon SNDCTL_DSP_RESET. - Uses win32 event to signal buffer out

Re: setfragment patch for sound device

2003-09-10 Thread Christopher Faylor
On Thu, Sep 11, 2003 at 12:29:12PM +0800, peter garrone wrote: > > The following patch to the /dev/dsp sound device does the following: > > - implements SNDCTL_DSP_SETFRAGMENT, allowing smaller sound buffers to be used. > - trivially implements SNDCTL_DSP_CHANNELS. > - opens and closes the class d

Re: Fixing a security hole in pinfo.

2003-09-10 Thread Christopher Faylor
On Thu, Sep 11, 2003 at 12:27:00AM -0400, Pierre A. Humblet wrote: >At 12:15 AM 9/11/2003 -0400, you wrote: >>On Thu, Sep 11, 2003 at 12:05:42AM -0400, Pierre A. Humblet wrote: >>>The flag PID_MAP_RW is added in the few pinfo constructors >>>that need to be write into _pinfo if it exists. >>>[snip