findMember() on 32-bit platforms can also suffer an infinite loop and probably worse outcomes. The off_t is a 32-bit value on 32-bit platforms with a maximum value of 2147483647; the maximum value stored in the ar_size member can be 9999999999. This allows ample opportunities for mischief, the most obvious being an infinite loop is possible because the fseek() calls are not monotonically moving forward. Another possibility is that a package will verify on a 64-bit host but not 32-bit, or vice-versa, or may select different payloads on different systems.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1358272 Title: [MIR] debsig-verify To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/debsig-verify/+bug/1358272/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
