On Sun, 25 Jun 2006, [EMAIL PROTECTED] announced authoritatively: > On Wednesday 21 June 2006 21:38, Nix wrote: [jmp_buf goes hidden] >> This vile patch lets me compile but is almost certainly not good enough: >> however, I don't know what *is* good enough: now that glibc is blocking >> us from the layout of the jmp_buf, what's to stop them from changing it? >> (Well, other than that it would break the ABI ;) ) > I made the same thought, but no, they have *already* changed it. > Search for the message from Ulrich Drepper
It's not easy to find it given that little info :( > (and if you understand > the "security reasons" I'd be curious to hear them); Well, there are obvious security problems with having pointers in jmp_buf exposed: attackers who can exploit a buffer overflow and know the location of a jmp_buf and its layout can force someone to longjmp() to any location they like, regardless of -fstack-protector tricks. Even FORTIFY_SOURCE won't protect against it if the buffer overrun didn't use strcpy() or a similarly fortified call. > also the below patch is > available in Jeff's tree from some time. Aha, great minds kludge alike ;) > I asked Jeff to #ifdef that code out for 2.6.17 release (since the below > patch > was refused)... anyway Jeff found that we can take setjmp() implementation > from klibc and include it in UML. Well, it wasn't ifdeffed out ;) Using the uml setjmp() implementation seems like a good idea (or the uClibc one). -- `NB: Anyone suggesting that we should say "Tibibytes" instead of Terabytes there will be hunted down and brutally slain. That is all.' --- Matthew Wilcox Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ User-mode-linux-devel mailing list User-mode-linux-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
