On Mon, Mar 11, 2002 at 12:36:02PM -0800, Jonathan R. Hinds wrote:
> http://www.gzip.org/zlib/advisory-2002-03-11.txt
> 
> Anything previous to 1.1.4 apears to be vulnerable.

The malloc implementation which is in NetBSD isn't very vulnerable
to a double free(). I believe that Free/Net/Open all use the same
one, which originally came from FreeBSD.

Probably because of this reason, OpenBSD declared itself 'not
vulnerable'.

I did upgrade the zlib in the NetBSD tree, though. It didn't have
many changes, I may ask for it to be pulled up into 1.5.3. But
to be short, generally the malloc in *BSD is not believed to
be vulnerable.

(for the kernel it isn't an issue, as libz is only linked to
bootblocks in situations that don't have 3rd party input)

- Frank

-- 
Frank van der Linden                           fvdl@wasabisystems.com
======================================================================
Quality NetBSD CDs, Support & Service.   http://www.wasabisystems.com/