Re: [DAEMON] Expecting to tag tomorrow

2022-11-22 Thread Gary Gregory
Sounds good! Gary On Tue, Nov 22, 2022, 14:12 Mark Thomas wrote: > Hi all, > > This is just a heads up. > > I've just fixed a bug in DAEMON so I am expecting to tag 1.3.3 tomorrow > so the next round of Tomcat releases can pick up a version of Daemon > with the fix. > > Mark > > ---

[DAEMON] Expecting to tag tomorrow

2022-11-22 Thread Mark Thomas
Hi all, This is just a heads up. I've just fixed a bug in DAEMON so I am expecting to tag 1.3.3 tomorrow so the next round of Tomcat releases can pick up a version of Daemon with the fix. Mark - To unsubscribe, e-mail: dev-

Re: [commons-bcel] branch master updated: Validate the u4 length of all attributes

2022-11-22 Thread Gary Gregory
Makes sense I think, thank you Mark. Gary On Tue, Nov 22, 2022, 08:41 Mark Thomas wrote: > On 22/11/2022 13:10, Gary D. Gregory wrote: > > I am concerned that the recent fixes we've made through OSS fuzz and > code inspection to validate input are semantically incorrect: The verifier > should c

Re: [commons-bcel] branch master updated: Validate the u4 length of all attributes

2022-11-22 Thread Mark Thomas
On 22/11/2022 13:10, Gary D. Gregory wrote: I am concerned that the recent fixes we've made through OSS fuzz and code inspection to validate input are semantically incorrect: The verifier should catch these errors, not the construction of Java objects. This could be a case where fuzzing and lo

Re: [commons-bcel] branch master updated: Validate the u4 length of all attributes

2022-11-22 Thread Gary D. Gregory
I am concerned that the recent fixes we've made through OSS fuzz and code inspection to validate input are semantically incorrect: The verifier should catch these errors, not the construction of Java objects. This could be a case where fuzzing and low-level code inspections only appear to find i