This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH v2 5/5] posix: Use posix_spawn for wordexp
- From: Florian Weimer <fweimer at redhat dot com>
- To: Carlos O'Donell <carlos at redhat dot com>
- Cc: Adhemerval Zanella <adhemerval dot zanella at linaro dot org>, libc-alpha at sourceware dot org
- Date: Tue, 08 Oct 2019 11:58:31 +0200
- Subject: Re: [PATCH v2 5/5] posix: Use posix_spawn for wordexp
- References: <20190731183136.21545-1-adhemerval.zanella@linaro.org> <20190731183136.21545-5-adhemerval.zanella@linaro.org> <87d0f8e4fu.fsf@oldenburg2.str.redhat.com> <4c19ff5a-2636-5537-a52e-cd3564d82e65@redhat.com>
* Carlos O'Donell:
> On 10/7/19 3:33 PM, Florian Weimer wrote:
>> * Adhemerval Zanella:
>>
>>> diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
>>> index 10a0768a6b..ef780b0a65 100644
>>> --- a/posix/wordexp-test.c
>>> +++ b/posix/wordexp-test.c
>>
>>> -/* For each fork increment the fork count. */
>>> -static void
>>> -register_fork (void)
>>> -{
>>> - registered_forks++;
>>> -}
>>
>> It's a bit sad to see this testing go away. It was originally added to
>> catch command execution with WRDE_NOCMD.
>>
>> On Linux, could you enter a PID namespace instead and check that the
>> next PID has the expected value?
>>
>> Carlos, you added this testing. Do you have an opinion here?
>
> We should not regress testing WRDE_NOCMD, because doing so is what
> lead to CVE-2014-7817 :-(
>
> We should expend some effort here to provide robust testing for
> WRDE_NOCMD.
I'm working on it.
Thanks,
Florian