[MPlayer-dev-eng] [RFC] check for correct calloc

[Reimar Döffinger]

Hello,
On Fri, Sep 14, 2007 at 12:28:24AM +0200, Balatoni Denes wrote:
> Thursday 13 September 2007 21:31-kor Reimar Döffinger ezt írta:
> > Hello,
> > in light of this
> > http://www.vulnhunt.com/advisories/CAL-20070912-1_Multiple_vendor_produce_h
> >andling_AVI_file_vulnerabilities.txt and the corresponding libc bug
> > http://cert.uni-stuttgart.de/advisories/calloc.php
> > I'd propose attached patch that makes MPlayer refuse to run without an
> > extra flag.
> > Unfortunately I don't have any broken libc so I can't really test.
> > Do you think that is desirable? Or do you think it's a stupid idea?
> 
> I am against this because if somebody is so security councious, he/she should 
> upgrade his/her libc, instead of us working around the bugs in other packages 
> (and if somebody is not so security councious, than why would he care if 
> there is one more way to make mplayer segfault).

Hmm.. did we discuss this before already or is my mind playing tricks on
me?
Either way, you misunderstood this, if the libc is working MPlayer might
segfault, if it does not then it will be a heap overflow.
And the point is to make people aware that they have a broken libc (and
there are more than glibc and other equally well supported versions).

Greetings,
Reimar Döffinger