15 years later: remote code execution in qmail
1–10 of 164 posts
Re: 15 years later: remote code execution in qmail
#2Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests).
/* this line is unreachable */
printf("You have reached unreachable code\n");
Re: 15 years later: remote code execution in qmail
#3Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests). /* this line is unreachable */ printf("You have reached unreachable code\n"); 10 years later, it gets printed...
Why not exit/panic at that point? Seems like the right thing for any “unreachable” code.
Re: 15 years later: remote code execution in qmail
#4Do we know if they have applied for the $500 bug bounty from DJB?
Re: 15 years later: remote code execution in qmail
#5Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests). /* this line is unreachable */ printf("You have reached unreachable code\n"); 10 years later, it gets printed...
Why not exit/panic at that point? Seems like the right thing for any “unreachable” code.
Ego.
Re: 15 years later: remote code execution in qmail
#6Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?
Re: 15 years later: remote code execution in qmail
#7Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests). /* this line is unreachable */ printf("You have reached unreachable code\n"); 10 years later, it gets printed...
Why not exit/panic at that point? Seems like the right thing for any “unreachable” code.
Because it will never happen I guess. From my experience, it's because of this bad habbit of expecting the program to crash and provide a backtrace,the print is there for debugging. But you're right,it's not the sane way of doing it.
Re: 15 years later: remote code execution in qmail
#8Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests). /* this line is unreachable */ printf("You have reached unreachable code\n"); 10 years later, it gets printed...
Why not exit/panic at that point? Seems like the right thing for any “unreachable” code.
Didn't think of it? If I saw a line like that I'd be grateful that it printed at all.
Re: 15 years later: remote code execution in qmail
#9Do we know if they have applied for the $500 bug bounty from DJB?
My guess is that he'd never accept it. He originally didn't allow people to distribute qmail with changes; this is squarely a Debian issue.
Re: 15 years later: remote code execution in qmail
#10Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?
It's not "they", it's Daniel J. Bernstein. That's the reason :)
(If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)