[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1403941006.29897.18.camel@scapa>
Date: Sat, 28 Jun 2014 09:36:46 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: "H. Peter Anvin" <hpa@...or.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: LMS-2014-06-16-1: Oberhumer LZO
On ven., 2014-06-27 at 14:46 -0700, H. Peter Anvin wrote:
> On 06/26/2014 02:21 PM, Yves-Alexis Perez wrote:
> > - syslinux [5] seems to embeds lzo but I'm unsure if the vulnerable
> > code is really present, I can't find lzo1x_decompress_safe() code
>
> For the record, I just upgraded Syslinux to LZO 2.07. The only code
> that ends up in the Syslinux build at all changed only in comments and
> in #if'd out code.
Thanks for the investigation. Is there a reason not to link with lzo
instead of embedding it?
> The only use of LZO is in the Syslinux core, which
> uses the assembly LZO implementation, which seems to have been unaffected.
Good point, my searches indeed usually don't include any non-C
implementation, which might or might not be affected.
>
> Syslinux does not use LZO on arbitrary data.
Thanks, so that's three reasons syslinux itself is not affected:
- embedded LZO didn't contain the affected code;
- syslinux core LZO assembly implementation is not touched;
- LZO is done only on controlled data (not under anyone control?)
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
