5 ms·
As a fun aside: The Symbolics network code called READ on untrusted data on more than one occasion.
by eudox 12y ago
As a fun aside: The Symbolics network code called READ on untrusted data on more than one occasion.
- lispm 12y agoHave you seen that code? I just searched through sys:network; and sys:ip-tcp; in Genera 8.3 and the only use of READ was in an Eval server.
- eudox 12y agoI read it on a tweet somewhere.
- lispm 12y agoThen it must be true.
- ScottBurson 12y agoI distinctly recall, c. 1983, that 'read' was called as part of the NFILE protocol. The reason I noticed was that I had created a package that did not use 'lisp:', and therefore 'nil' was no longer 'lisp:nil', which broke the NFILE client. Maybe this got fixed sometime between then and 8.3. (Or maybe NFILE was ripped out altogether?) I also recall that Jeff Schiller found some remote vulnerabilities. I don't know if they involved 'read', but they certainly could have. Again, this was long before 8.3.
- lispm 12y agoAre you sure? There is a READ command in NFILE, but there are no obvious calls to READ. Symbols could have been created or looked up by other means...