Be33eD <[email protected]> writes: > An attacker who controls the contents, sizes, and number of the files > passed to `tac` can cause a deterministic heap out-of-bounds read. The > trigger requires the operator to use a non-regular-expression multi-byte > separator of length at least 3 (`tac -s STR`) together with at least two > file operands. No special privileges are required, and the default newline > separator and the `-r` regular-expression mode are unaffected.
Thanks for the report, but I don't really see how this is a security issue, as implied by "attacker". If someone has access to run tac with arbitrary files and arguments, that implies they have a shell, no? Certainly, they could find something more productive to do. Collin
