Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Posted Apr 27, 2015 20:42 UTC (Mon) by paulj (subscriber, #341)In reply to: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) by wahern
Parent article: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
1. A simple bounded, checking buffer is pretty trivial to write. A 1.0 implementation:user ratio is fine, it's so simple. (Or otherwise use Quagga's, though there's a bit of cruft in its one to strip out - but it's not exactly a large or complex bit of code).
2. It's worked pretty for well for Quagga and GNU Zebra before that.
Quagga has had a good number of DoS bugs, which otherwise would have been remote exploits, thanks to it generally using a simple bounded buffer in between IO and parsing. At least, in its 2 most widely used daemons.
There's still a good bit of network facing parsers that don't use that abstraction, but in less widely used stuff usually. Which we have to eradicate.
