Subject: Re: FYI: Buffer overflow in traceroute
To: Erik E. Fair <fair@clock.org>
From: Warner Losh <imp@village.org>
List: tech-security
Date: 06/13/1998 23:41:14
: (I recommend grep'ing for h_length on your source tree. We've been doing
: it for Linux, and it's depressing what's been turning up.)
Having made this change for most of FreeBSD, I think it is somewhat
bogus and had planned to back it out. It was really bogus and Theo
pointed out to me what was so bogus about it.
gethostby{name,addr} and getnet* are better places to fix this sort of
thing. They shouldn't, imho, return addresses lengths > 4. IPng uses
a gethostbyname2 for this sort of thing. the gethostbyname man page
implies that it only looks up AF_INET addresses, which are, by
definition, 4 bytes long.
Just my HO, your milage may vary.
Warner