Re: [HACKERS] MySQL vulnerability - Mailing list pgsql-hackers

From Goran Thyni
Subject Re: [HACKERS] MySQL vulnerability
Date
Msg-id 36ADF223.9CF728AA@kirra.net
Whole thread Raw
In response to MySQL vulnerability  ("Thomas G. Lockhart" <lockhart@alumni.caltech.edu>)
List pgsql-hackers
"Thomas G. Lockhart" wrote:
> Are we vulnerable to stack or buffer overflows with our on the wire
> protocol?

There are lots of sprintf and such in there, 
which are potential stack overflows.

A security audit should be good thing, but it is a where time consuming
(and not very fun) task in a complex system like a RDBMS.
regards,
-- 
-----------------
Göran Thyni
This is Penguin Country. On a quiet night you can hear Windows NT
reboot!



pgsql-hackers by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: Non-blocking queries in postgresql
Next
From: Goran Thyni
Date:
Subject: Re: [HACKERS] Re: alloca (was: Postgres Speed or lack thereof)