3 ms·

Somebody wrote new code which uses strcat() in 2012 (the commit which introduced that bug was written in June 2012)? That's.. wow.. unbelievable.

• xxpor 14y ago
  Is this kind of stuff not code reviewed?
  • nolok 14y ago
    It's an open source project, you are free to do so if you have the time or the need, and contribute back any corrections.
    • xxpor 14y ago
      I guess I'm just idealistic, but I would think for something this security sensitive or important (see "Fixing" TWO in glibc), they would have code reviews before anything could be committed. In this case, a automated system rejecting anything that uses the non "n"(strcat vs strncat, etc.) version of the string functions in C would have worked.
      • peterwwillis 14y ago
        If you expect code reviews and automated tests for an open-source product that's developed in spare time for no money, you can go to this page (http://curl.haxx.se/donation.html http://curl.haxx.se/donation.html), click the PayPal button, and be very very generous.
    • agwa 14y ago
      This is only a partially-accurate description of how most open source projects work. While code review of the core developers is rare, patches from outside contributors typically are scrutinized before being applied. The curl vulnerability was introduced by an outsider's patch so I am troubled that it wasn't noticed before being committed.