nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

fix #Q101 - score file bullet proofing

Browse Source 
Guard against buffer overflows when reading in score entries, in case
`record' has become corrupted or been maliciously modified.  This addresses
the part of "#Q101: Security bug in nethack 3.4.3" that we have control
over.  A Gentoo bug tracking discussion pointed out to us by <email deleted>, describes how that particular Linux
distribution makes users be members of the games group, allowing them to
modify files in nethack's playground directory when it has been set up in
the usual ``setgid games'' manner, thus making score processing in that
environment be vulnerable to buffer overrun exploits.
This commit is contained in:
nethack.rankin
2007-03-06 03:33:49 +00:00
parent 5a874440a0
commit 5702e2065d
2 changed files with 52 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/fixes34.4
+1
View File
@@ -334,6 +334,7 @@ don't give a speed change message when an immobile monster is seen to be hit
when shopkeeper "gratefully inherits possessions" of hero who dies in shop
doorway without owing the shop, move those items inside shop for bones
dying in a shop while wielding two weapons could cause "Setworn: mask" warning
make score file processing more bullet proof to avoid potential security issue
Platform- and/or Interface-Specific Fixes