[Full-disclosure] Re: readdir_r considered harmful

2005-11-01 Thread Ben Hutchings
I wrote: > readdir_r considered harmful > A second revision of this advisory (and any future revisions) can be found at <http://womble.decadentplace.org.uk/readdir_r-advisory.html>. I have updated the recommendations to cover HP-UX and Tru64 properly. B

Re: [Full-disclosure] readdir_r considered harmful

2005-11-01 Thread Ben Hutchings
3APA3A wrote: > Dear Ben Hutchings, > > > If someone uses pathconf to determine buffer size it's his own problem > and he creates vulnerability by himself. You can list such applications > as vulnerable to race conditions. > NAME_MAX is defined in limits.h and

[Full-disclosure] readdir_r considered harmful

2005-11-01 Thread Ben Hutchings
readdir_r considered harmful Issued by Ben Hutchings <[EMAIL PROTECTED]>, 2005-11-01. Background -- The POSIX readdir_r function is a thread-safe version of the readdir function used to read directory entries. Whereas readdir returns a pointer to a