Re: ssh crc32 exploit on Linux

From: Michael Wojcik (Michael.Wojcikat_private)
Date: Mon Apr 30 2001 - 08:42:38 PDT

  • Next message: Rajkumar S.: "Re: Hijack IP Address using cable modem"

    > From: Michel Kaempf [mailto:maxxat_private]
    > Sent: Sunday, April 29, 2001 6:56 AM
    
    > realloc with a size argument of zero (re)allocates a minimum-sized
    > chunk, or frees the previous allocated chunk if REALLOC_ZERO_BYTES_FREES
    > is defined in malloc.c. And the default *is* to define
    > REALLOC_ZERO_BYTES_FREES, so realloc with a size argument of zero frees
    > the chunk and returns NULL.
    
    This behavior (realloc with a non-null pointer and a size of 0 causes the
    space referred to by pointer to be freed) is mandated by ANSI/ISO C in the
    1990 standard (ISO 9899-1990, aka C90).  See 7.10.3.4.  C90 does not specify
    what malloc does with a size of 0.
    
    However, the draft C99 standard removes this language (see 7.20.3), and
    according to Annex J (which is informative, not normative), the behavior of
    malloc(), calloc(), and realloc() with a size of 0 is unspecified by the
    standard.  I don't have a copy of the final C99 standard, so I don't know if
    this was changed after the draft.
    
    Since C99 apparently does not forbid the C90 behavior of realloc(ptr,0), and
    since conforming C90 programs may rely on it, my guess is that most C99
    implementations will continue to support it.
    
    I'm not sure what CORE-SDI based their "most modern systems" comment on.
    Most of the modern systems I work with claim to have conforming C90
    compilers, so realloc(ptr,0) should return NULL and be otherwise equivalent
    to free(ptr), as Franklin DeMatto observed in the original note in this
    thread.
    
    Michael Wojcik             michael.wojcikat_private
    MERANT
    Department of English, Miami University
    



    This archive was generated by hypermail 2b30 : Mon Apr 30 2001 - 10:08:05 PDT