Subject: Re: FYI: Buffer overflow in traceroute
To: Erik E. Fair <fair@clock.org>
From: Warner Losh <imp@village.org>
List: tech-security
Date: 06/13/1998 23:41:14
: (I recommend grep'ing for h_length on your source tree.  We've been doing
:  it for Linux, and it's depressing what's been turning up.)

Having made this change for most of FreeBSD, I think it is somewhat
bogus and had planned to back it out.  It was really bogus and Theo
pointed out to me what was so bogus about it.

gethostby{name,addr} and getnet* are better places to fix this sort of
thing.  They shouldn't, imho, return addresses lengths > 4.  IPng uses
a gethostbyname2 for this sort of thing.  the gethostbyname man page
implies that it only looks up AF_INET addresses, which are, by
definition, 4 bytes long.

Just my HO, your milage may vary.

Warner