I demand that Florian Grunow may or may not have written... > Debian gxine uses the HOME environment variable without proper bounds > checking in version 0.5.8. This results in a buffer overflow when the HOME > environment variable is longer than or equal to 242. It is possible to > execute code, which doesn't seem to be the case in version 0.5.9. Version > 0.5.9 (not tested as .deb, built from source) simply segfaults.
Actually, any filename >= 108 characters long is too long anyway (due to the size of the sun_path field in struct sockaddr_un). This is now tested for in what should soon become 0.5.10. The patch is here: <URL:http://zap.tartarus.org/~ds/hg/gxine/?cmd=changeset;node=f3496e5e172f;style=gitweb> I'll prepare a 0.5.8 update with this patch, but I'd like to know (from an RM's point of view) which of the patches in the existing 0.5.8-2 should make it into etch. I'd like to include, at least, the patches for the locking bugs (-release CC'ed for this reason). <URL:http://zap.tartarus.org/~ds/debian/dists/unstable/main/source/gxine_0.5.8-2.dsc> - not for upload, at least not without the extra patch. -- | Darren Salt | linux or ds at | nr. Ashington, | Toon | RISC OS, Linux | youmustbejoking,demon,co,uk | Northumberland | Army | Kill all extremists! I am Spock of Borg. Resistance is illogical. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]