Nginx security advisory (CVE-2013-2028)

Re:Nginx security advisory (CVE-2013-2028) by unix-junkie on Tuesday May 07, 2013 @12:46PM (#5669113)

I don't get it, it seems to me that this fix is incorrect.

It's pointless to check for such a signed integer overflow after it happened.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by bcoates on Tuesday May 07, 2013 @06:33PM (#5671286)

I think you're right, unless nginx uses --fwrapv or it's equivalent on every compiler.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by lysium on Tuesday May 07, 2013 @04:18PM (#5670510)

Why is length stored with a signed integer in the first place?

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by tptacek on Tuesday May 07, 2013 @06:24PM (#5671222)

It's (mis)using off_t, which allows for negative offsets (for obvious reasons). You also don't need signed integers to have integer overflows.

[ Parent | on HN ]