Subject: Is it worthwhile to fix globbing issues for /bin/sh?
To: None <tech-security@netbsd.org>
From: Jeremy C. Reed <reed@reedmedia.net>
List: tech-security
Date: 03/16/2001 14:49:03
Is anyone working on globbing issues with /bin/sh?

(/bin/sh has its own internal globbing, not libc.)

Does it matter if /bin/sh's file expansion can take up a bunch of
resources? I guess it doesn't matter, because you can define the resources
available for each user.

But maybe some daemons use /bin/sh's globbing which could cause a DoS?

Any thoughts?

I patched my src/bin/sh/expand.c to workaround the problem -- but it isn't
right. After a few times of testing then "ls *" stops working. (Somehow I
am not releasing the expansion list or reseting my counter.)

   Jeremy C. Reed
   http://www.reedmedia.net/