Re: first patch to security problem

[Adam Langley <agl@linuxpower.org>]

On Sat, Aug 26, 2000 at 05:36:59PM +1000, Peter wrote:
> > If I make a patch tomorrow to call execvp directly will you consider
> > it?
> 
> Sure, but it's painfull. You'll have to worry about a argv[] array, and
> $PATH.
> 

This is the only valid way to do it. Shells *are not* ever secure in network
apps. And you should look at the manpage for execvp because it searches the
path for you if the strchr(command, '\') == NULL.

AGL

-- 
When will people realise that we don't care for their damm stupid laws? We can handle ourselves, thank you very much.

PGP signature