Your message dated Mon, 29 Sep 2014 11:12:48 +0000
with message-id <e1xyysq-0007l4...@franck.debian.org>
and subject line Bug#763267: Removed package(s) from unstable
has caused the Debian Bug report #702889,
regarding Passes literal struct instead of pointer-to-struct
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
702889: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702889
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: afpfs-ng
Version: 0.8.1-5
Severity: critical
Tags: security
Justification: user-controllable pointer value
Usertags: goto-cc
When typechecking the linked binary using our research compiler infrastructure
it became apparent that various calls to remove_opened_fork pass a struct (of
type struct afp_file_info) as second argument instead of first taking the
address thereof. (A simple grep -r remove_opened_fork . suffices to see these).
Thus the first 4 or 8 byte of the struct will be cast to an address, which (on
little endian 64bit systems) includes part of file creation date. By an
appropriate choice thereof it may be possible to tweak the pointer to a
user-defined value, with hard-to-limit consequences.
Fixing the problem is trivial, it just requires inserting address-of operators.
It could all be diagnosed right at compile time if proper function declarations
(or included header files) were present.
Best,
Michael
PS.: The Clang build(-attempt) hints at a number of further problems with this
code:
http://clang.debian.net/logs/2013-01-28/afpfs-ng_0.8.1-5_unstable_clang.log
pgpSO5ff1gsy1.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
Version: 0.8.1-5+rm
Dear submitter,
as the package afpfs-ng has just been removed from the Debian archive
unstable we hereby close the associated bug reports. We are sorry
that we couldn't deal with your issue properly.
For details on the removal, please see https://bugs.debian.org/763267
The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.
This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.
Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)
--- End Message ---
