OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: SysVinit audit: mesg and wall
From: Tim Robbins (fyrebox3n.gumbynet.org)
Date: Sun Sep 03 2000 - 05:57:34 CDT

On Sat, 2 Sep 2000, Solar Designer wrote:

> The write from util-linux, yes. Here's the relevant fix I've applied
> for Owl a month ago:
>
> +#define fixed_iscntrl(c) \
> + (((c) & 0x7f) < 0x20 || (c) == 0x7f)
>
> - } else if (!isprint(c) && !isspace(c) && c != '\007') {
> + } else if (iscntrl(c) || fixed_iscntrl(c)) {
>
> (Actually, I also had to disable locale support in write entirely for
> other similar reasons, but left this fix as well just in case.)

Have you added something like:
  setlocale(LC_CTYPE, "C");
after:
  setlocale(LC_ALL, "");

Or have you done it another way? I haven't paid much attention to locale
when auditing code, I'll have to go back and check over a few things now.

wall from SysVinit doesn't play with the locale at all, and
setlocale(3) says that the "C" locale is the default, but I still think
your decision to not support suid or sgid execution of wall is wise.

You seem to have found quite a lot of problems with SysVinit, utl-linux,
etc. and patched them... Are you planning on making these patches public
eventually?

Tim