Re: Possible security hole

2003-10-04 Thread jw schultz
On Sat, Oct 04, 2003 at 04:56:16PM -0700, Wayne Davison wrote: > On Sat, Oct 04, 2003 at 11:38:48PM +0300, Timo Sirainen wrote: > > for (i=0; i < (int) s->count;i++) { > > Yeah, that's pretty bad. Attached is a patch that should fix this and a > number of other related problems where the code

Re: Possible security hole

2003-10-04 Thread Wayne Davison
On Sat, Oct 04, 2003 at 11:38:48PM +0300, Timo Sirainen wrote: > for (i=0; i < (int) s->count;i++) { Yeah, that's pretty bad. Attached is a patch that should fix this and a number of other related problems where the code assumed that size_t would fit into an int. There looks to be a bunch

Re: Possible security hole

2003-10-04 Thread jw schultz
On Sat, Oct 04, 2003 at 11:38:48PM +0300, Timo Sirainen wrote: > Maybe security related mails should be sent elsewhere? I didn't notice > any so here it goes: > > sender.c:receive_sums() > > s->count = read_int(f); > .. > s->sums = (struct sum_buf *)malloc(sizeof(s->sums[0])*s->count

Possible security hole

2003-10-04 Thread Timo Sirainen
Maybe security related mails should be sent elsewhere? I didn't notice any so here it goes: sender.c:receive_sums() s->count = read_int(f); .. s->sums = (struct sum_buf *)malloc(sizeof(s->sums[0])*s->count); if (!s->sums) out_of_memory("receive_sums"); for (i=0; i

Re: Cygwin/rsync Hang Problem Testing Results

2003-10-04 Thread jw schultz
On Sat, Oct 04, 2003 at 08:38:20AM +0200, Lapo Luchini wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Paul Thompson wrote: > > | 2.4.5 success success 2.4.6 failure failure > > Funny this is: 2.4.6 is exactly the release where many cygwin-related > patches landed in