[CrackMonkey] Another nail in the Pine coffin

[Paul J Collins]

>>>>> "Aaron" == Aaron Lehmann <aaronl at vitelus.com> writes:

    Aaron> On Fri, Sep 29, 2000 at 09:26:22AM -0700, Don Marti wrote:
    >> ----- Forwarded message from Kris Kennaway <kris at FREEBSD.ORG> -----
    >> Don't use pine - I don't believe it is practical to make it secure. :-(

    Aaron> I can't believe that no one has bothered to point out how
    Aaron> fucking stupid this conclusion is. The three calls grepped
    Aaron> for are no indication of security or lack of it.

Your contrived example does not prove that every use of those
functions in Pine is safe and not prone to buffer overflows.  It is
only safe because you /know/ that the input to strcpy is
NUL-terminated.  Are you prepared to check every usage of these risky
functions in Pine?  Is any other Pine user?  Are the authors of Pine?

Your example might have held a drop more water if it was actually a
safe usage of one of the mentioned functions from the Pine code-base.

Your comment about the ``broken operating system'' puzzles me.  Are
you referring to Unix?  If so, which one?  All of them?

By the way, use of the integer constant 0 for '\0' is not a good idea.
Say what you mean.

-- 
Paul Collins <sneakums at eircom.net> - - - - - [ A&P,a&f ]
 GPG: 0A49 49A9 2932 0EE5 89B2  9EE0 3B65 7154 8131 1BCD
``Attention all MP3s: resistance is futile.
  You will be vorbized.''