Bug#408530: libcapi20-3: buffer overflow in "printbuf" called from capi_cmsg2str

[Ben Hutchings]

clone 408530 -1 -2
reassign -1 asterisk-chan-capi
retitle -1 asterisk-chan-capi: Need a mutex for calls to capi_{cmsg,message}2str
reassign -2 linux-2.6
retitle -2 linux-2.6: capi_{cmsg,message}2str not thread-safe; vulnerable to 
buffer overflow
block -1 with 408530
tags -2 upstream
forwarded -2 http://bugzilla.kernel.org/show_bug.cgi?id=8028
thanks

This function and capi_message2str are not thread-safe either; nor can
they be made so without the use of TSS for their buffers.  chan_capi
will need to use a mutex to prevent collision between concurrent uses of
these functions.  I don't know what can be done in the kernel.  The
buffer overflow could conceivably be due to two concurrent calls to
these functions rather than a single message.

Ben.

-- 
Ben Hutchings
It is easier to change the specification to fit the program than vice versa.

signature.asc
Description: This is a digitally signed message part