Development of CLISP

SourceForge.net | 2 Jan 2006 00:26

Picon

[ clisp-Bugs-1389060 ] 1d23 output bug

Bugs item #1389060, was opened at 2005-12-23 13:17
Message generated for change (Comment added) made by sds
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=101355&aid=1389060&group_id=1355

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: clisp
Group: lisp error
>Status: Closed
>Resolution: Fixed
Priority: 5
Submitted By: Sam Steingold (sds)
Assigned to: Sam Steingold (sds)
>Summary: 1d23 output bug

Initial Comment:
(multiple-value-list (integer-decode-float 1d23))
 ==> (5960464477539062 24 1)
should be: 
 ==> (5960464477539063 24 1)

(prin1-to-string 1d23)
 ==> "9.999999999999999E22"
should be:
 ==> "1.0E23"

----------------------------------------------------------------------

(Continue reading)

clisp-cvs-request | 2 Jan 2006 05:09

Picon

clisp-cvs digest, Vol 1 #1382 - 12 msgs

Send clisp-cvs mailing list submissions to
	clisp-cvs <at> lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/clisp-cvs
or, via email, send a message with subject or body 'help' to
	clisp-cvs-request <at> lists.sourceforge.net

You can reach the person managing the list at
	clisp-cvs-admin <at> lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of clisp-cvs digest..."

CLISP CVS commits for today

Today's Topics:

   1. clisp/src ChangeLog,1.5196,1.5197 (Sam Steingold)
   2. clisp configure,1.94,1.95 (Sam Steingold)
   3. clisp/modules/postgresql postgresql.xml,1.7,1.8 (Sam Steingold)
   4. clisp/doc impext.xml,1.439,1.440 (Sam Steingold)
   5. clisp/src time.d,1.50,1.51 ChangeLog,1.5197,1.5198 (Sam Steingold)
   6. clisp/tests time.tst,1.4,1.5 ChangeLog,1.447,1.448 (Sam Steingold)
   7. clisp/src format.lisp,1.46,1.47 floatprint.lisp,1.5,1.6 ChangeLog,1.5198,1.5199 (Sam Steingold)
   8. clisp/tests number2.tst,1.30,1.31 ChangeLog,1.448,1.449 (Sam Steingold)
   9. clisp/src spvw.d,1.373,1.374 (Sam Steingold)
  10. clisp COPYRIGHT,1.15,1.16 (Sam Steingold)
  11. clisp/doc impnotes.xml.in,1.87,1.88 clisp.xml.in,1.58,1.59 (Sam Steingold)
  12. clisp/src subr.d,1.215,1.216 spvw.d,1.374,1.375 pathname.d,1.389,1.390 misc.d,1.81,1.82

(Continue reading)

clisp-cvs-request | 2 Jan 2006 18:11

Picon

clisp-cvs digest, Vol 1 #1384 - 3 msgs

Send clisp-cvs mailing list submissions to
	clisp-cvs <at> lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/clisp-cvs
or, via email, send a message with subject or body 'help' to
	clisp-cvs-request <at> lists.sourceforge.net

You can reach the person managing the list at
	clisp-cvs-admin <at> lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of clisp-cvs digest..."


CLISP CVS commits for today

Today's Topics:

   1. clisp/src version.h,1.41,1.42 (Sam Steingold)
   2. clisp/win32msvc makefile.msvc7,1.22,1.23 makefile.msvc6d,1.12,1.13 makefile.msvc6,1.12,1.13 makefile.msvc5d,1.22,1.23 makefile.msvc5,1.58,1.59 makefile.msvc4,1.56,1.57 (Sam Steingold)
   3. clisp/src/po ru.po,1.21,1.22 ru.gmo,1.15,1.16 nl.po,1.19,1.20 nl.gmo,1.15,1.16 fr.po,1.20,1.21 fr.gmo,1.15,1.16 es.po,1.19,1.20 es.gmo,1.15,1.16 en.po,1.16,1.17 en.gmo,1.15,1.16 de.po,1.27,1.28 de.gmo,1.15,1.16 da.po,1.3,1.4 da.gmo,1.3,1.4 clisplow_ru.po,1.16,1.17 clisplow_ru.gmo,1.15,1.16 clisplow_nl.po,1.15,1.16 clisplow_nl.gmo,1.15,1.16 clisplow_fr.po,1.15,1.16 clisplow_fr.gmo,1.15,1.16 clisplow_es.po,1.15,1.16 clisplow_es.gmo,1.15,1.16 clisplow_en.po,1.15,1.16 clisplow_en.gmo,1.15,1.16 clisplow_de.po,1.15,1.16 clisplow_de.gmo,1.15,1.16 clisplow_da.po,1.3,1.4 clisplow_da.gmo,1.3,1.4 clisplow.pot,1.15,1.16 clisp.pot,1.15,1.16 (Sam Steingold)

--__--__--

Message: 1
From: Sam Steingold <sds <at> users.sourceforge.net>
To: clisp-cvs <at> lists.sourceforge.net
Subject: clisp/src version.h,1.41,1.42
Date: Mon, 02 Jan 2006 17:09:41 +0000

(Continue reading)

clisp-cvs-request | 2 Jan 2006 18:10

Picon

clisp-cvs digest, Vol 1 #1383 - 7 msgs

Send clisp-cvs mailing list submissions to
	clisp-cvs <at> lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/clisp-cvs
or, via email, send a message with subject or body 'help' to
	clisp-cvs-request <at> lists.sourceforge.net

You can reach the person managing the list at
	clisp-cvs-admin <at> lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of clisp-cvs digest..."


CLISP CVS commits for today

Today's Topics:

   1. clisp/modules/postgresql postgresql.xml,1.8,1.9 (Sam Steingold)
   2. clisp/tests number2.tst,1.31,1.32 (Sam Steingold)
   3. clisp/src floatprint.lisp,1.6,1.7 ChangeLog,1.5200,1.5201 (Sam Steingold)
   4. clisp/src clhs.lisp,1.42,1.43 ChangeLog,1.5201,1.5202 (Sam Steingold)
   5. clisp version.sh,1.7,1.8 clisp.lsm,1.22,1.23 (Sam Steingold)
   6. clisp/src NEWS,1.300,1.301 HISTORY,1.17,1.18 ChangeLog,1.5202,1.5203 (Sam Steingold)
   7. clisp/doc impnotes.html,1.45,1.46 _clisp.html,1.16,1.17 _clisp.1,1.18,1.19 (Sam Steingold)

--__--__--

Message: 1

(Continue reading)

Hoehle, Joerg-Cyril | 2 Jan 2006 18:34

Re: clisp/modules/syscalls calls.c,1.162,1.163

Sam Steingold wrote:

>> Update of /cvsroot/clisp/clisp/modules/syscalls
>> Modified Files:
>> 	calls.c 
>> Log Message:
>> typical buffer overflow vulnerability: must use syslog("%s",string)
>you forgot about "%m".
>I reverted your patch and added comments,
>but I welcome a discussion.

To me it seems like crazy to revert a security patch like the above.

Reverting trades a trivial to trigger buffer overflow crash against some obscure %m facility trivially
available via (linux:strerror linux:errno).

Reverting trades safe code against the only possible use as "Got error: %m", while "Got errno (%d): %m"
already breaks.  Are you willing to explain such subtleties to the user?  And I didn't even mention the
effect on people discovering why %-signs randomly disappear, which would be the most harmless effect.

The opportunity for DoS or stack overflow via syscalls:syslog made me wonder whether a CERT vulnerability
would be appropriate to issue, or whether the syscalls module is so obscure and hardly used that it would
not be worth a mention.
Such stack overflows are what many CERT vulnerabilities talk about.
It's solely lack of time on Dec. 23rd which caused me not to mention the security patch at least to clisp-users.

A CERT vulnerability notice has a lot of impact. It would oblige all distributors to generate and
distribute patches of clisp for all their supported versions. CLISP would get an entry in several
vulnerability databases (e.g. MITRE's NVD (formerly CVE)).  Whether that's good or bad publicity is not
the topic.

(Continue reading)

clisp-cvs-request | 2 Jan 2006 19:42

Picon

clisp-cvs digest, Vol 1 #1385 - 13 msgs

Send clisp-cvs mailing list submissions to
	clisp-cvs <at> lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/clisp-cvs
or, via email, send a message with subject or body 'help' to
	clisp-cvs-request <at> lists.sourceforge.net

You can reach the person managing the list at
	clisp-cvs-admin <at> lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of clisp-cvs digest..."

CLISP CVS commits for today

Today's Topics:

   1. clisp/src NEWS,1.301,1.302 (Sam Steingold)
   2. clisp/src ChangeLog,1.5203,1.5204 (Sam Steingold)
   3. clisp Makefile.devel,1.142,1.143 (Sam Steingold)
   4. clisp/modules/zlib configure.in,1.3,1.4 (Sam Steingold)
   5. clisp/modules/rawsock configure.in,1.22,1.23 (Sam Steingold)
   6. clisp/modules/pcre configure.in,1.6,1.7 (Sam Steingold)
   7. clisp/modules/pari configure.in,1.6,1.7 (Sam Steingold)
   8. clisp/modules/berkeley-db configure.in,1.9,1.10 (Sam Steingold)
   9. clisp/modules/i18n configure.in,1.6,1.7 (Sam Steingold)
  10. clisp/modules/dirkey configure.in,1.4,1.5 (Sam Steingold)
  11. clisp/src configure,1.154,1.155 (Sam Steingold)
  12. www summary.html,1.9,1.10 resources.html,1.15,1.16 index.php,1.43,1.44 .htaccess,1.1,1.2

(Continue reading)

Sam Steingold | 2 Jan 2006 20:09

Picon

Re: clisp/modules/syscalls calls.c,1.162,1.163

> * Hoehle, Joerg-Cyril <Wbret-Plevy.Ubruyr <at> g-flfgrzf.pbz> [2006-01-02 18:34:14 +0100]:
>
> Try (posix:syslog :err :mail "%s%s%s%s%s%s%s%s%s"), which crashed my
> Linux clisp.

there are many ways you can crash CLISP - e.g., by using %RECORD-STORE
to arbitrarily modify closures.

how is the syslog way more dangerous?

> Until now, I believe ffcall can't correctly interface to varargs
> functions.

this has nothing to do with ffcall.

> And you simply reverted such a patch?!?

chill out.  there is no reason to yell.  let's talk.

the only arguments for your patch I can think of is

- user expectations: special handling of % may be surprising

- %m is not needed because errno does not exist from the Lisp POV:
  all functions in POSIX signal errors instead of setting errno.
  OTOH, what if the user uses some foreign calls?
  then he should have errno available as a foreign thing as well.

--

-- 
Sam Steingold (http://www.podval.org/~sds) running w2k

(Continue reading)

Yaroslav Kavenchuk | 3 Jan 2006 10:24

Picon

environment variable LANG

clisp from CVS head, mingw

before `./configure... --build...` I set LANG=ENGLISH (as it is
described in the clisp.html), but final messages look so

 25             should-symbol:    0 errors out of     44 tests
╨Ф╨╛ ╤Б╨▓╨╕╨┤╨░╨╜╨╕╤П! ╨Э╨╡
╨┐╨╛╨╝╨╕╨╜╨░╨╣╤В╨╡ ╨╗╨╕╤Е╨╛╨╝!

Why?

Thanks!

--

-- 
WBR, Yaroslav Kavenchuk.

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click

Yaroslav Kavenchuk | 3 Jan 2006 10:36

Picon

build under WinXP

If build clisp in WinXP with option --with-module=bindings/win32, all
functions from win32 module not work in Win2k.

It is not critical (for me).
It is simply information.

Probably, binary distribution should be different for different Windows
versions.

Thanks!

--

-- 
WBR, Yaroslav Kavenchuk.

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click

Hoehle, Joerg-Cyril | 3 Jan 2006 11:23

Re: clisp/modules/syscalls calls.c,1.162,1.163

Sam Steingold wrote:
>the only arguments for your patch I can think of is
[2 reasons]
And those are reason enough, don't you think?

>how is the syslog way more dangerous?
>- user expectations: special handling of % may be surprising
That's the answer already.
Application programmers may log user-given input, e.g. URL's.  Thus specially crafted URL's can cause the
application to crash.

That's a very typical software vulnerability.

Telling the application programmer that he needs
(loop for pos = (position #\% output-for-syslog)
      ; either that or turn % to %%:
      do (ecase (char output (1+ pos)
          ((#\% #\m) t)))
would be way stupid, given that there's no way to make use of %s etc. in the interface the module provides so far.
My %s patch provides a no-surprise and robust interface to the syslog facility. Please scan the CERT
vulnerabilities. You will find exactly this patch in other packages. That's, BTW, how I came to look into
the syscalls package.

>  OTOH, what if the user uses some foreign calls?
>  then he should have errno available as a foreign thing as well.
Already there in the linux module (you may wish to duplicate it in posix?).

So I think that the next urgent thing is to fix the security gap. Too bad that clisp-2.37 is out in the
meantime. It would have been a perfect match: the hypothetical CERT message would have said "fixed in
2.37, please upgrade".

(Continue reading)

Group

gmane.lisp.clisp.devel.

Project Web Page

Development of CLISP

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 16

Articles in period: 156

January 2006

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[ clisp-Bugs-3610518 ] pari module fails to compile with pari-2.5.x (11 Apr 2013)
[ clisp-Bugs-3610521 ] pari module fails to compile with pari-2.5.x (11 Apr 2013)
[ clisp-Bugs-3610521 ] pari module fails to compile with pari-2.5.x (11 Apr 2013)
[ clisp-Bugs-3610518 ] pari module fails to compile with pari-2.5.x (11 Apr 2013)
[ clisp-Bugs-3485514 ] Cygwin & Pipes (9 Apr 2013)
[ clisp-Bugs-3485514 ] Cygwin & Pipes (30 Mar 2013)
[ clisp-Bugs-3608300 ] Link change (17 Mar 2013)
[ clisp-Bugs-3603480 ] unless test ignored when compiling (6 Feb 2013)
[ clisp-Bugs-3603421 ] glibc update (5 Feb 2013)
clisp-cvs Digest, Vol 71, Issue 1 (5 Feb 2013)
[ clisp-Bugs-3603421 ] glibc update (5 Feb 2013)
Porting to emscripten (26 Jan 2013)
[ clisp-Bugs-3601310 ] find-symbol in LINUX is wrong. (17 Jan 2013)
[ clisp-Bugs-3598754 ] sort + union destroys underlying union members (28 Dec 2012)
[ clisp-Bugs-3597512 ] eq load-time-value forms get coalesced (19 Dec 2012)
argv[0] not available to CLISP programs (20 Nov 2012)
Can clisp use swank ? (10 Oct 2012)
Can clisp use swank ? (10 Oct 2012)
Can clisp use swank ? (9 Oct 2012)
Can clisp use swank ? (9 Oct 2012)
[ clisp-Patches-3572516 ] Berkeley db module configure error (27 Sep 2012)

Archives

5	April 2013
3	March 2013
4	February 2013
6	January 2013
5	December 2012
5	November 2012
5	October 2012
13	September 2012
6	August 2012
12	July 2012
19	June 2012
19	May 2012
68	April 2012
17	March 2012
22	February 2012
8	January 2012
29	December 2011
10	November 2011
16	October 2011
52	September 2011
80	August 2011
101	July 2011
22	June 2011
46	May 2011
104	April 2011
51	March 2011
31	February 2011
19	January 2011
35	December 2010
55	November 2010
98	October 2010
100	September 2010
68	August 2010
103	July 2010
135	June 2010
52	May 2010
109	April 2010
125	March 2010
146	February 2010
33	January 2010
39	December 2009
64	November 2009
151	October 2009
178	September 2009
198	August 2009
243	July 2009
235	June 2009
85	May 2009
21	April 2009
27	March 2009
80	February 2009
104	January 2009
132	December 2008
257	November 2008
262	October 2008
221	September 2008
181	August 2008
259	July 2008
166	June 2008
307	May 2008
127	April 2008
203	March 2008
128	February 2008
205	January 2008
136	December 2007
325	November 2007
258	October 2007
41	September 2007
48	August 2007
15	July 2007
52	June 2007
33	May 2007
19	April 2007
59	March 2007
52	February 2007
57	January 2007
106	December 2006
132	November 2006
90	October 2006
62	September 2006
59	August 2006
80	July 2006
65	June 2006
66	May 2006
69	April 2006
55	March 2006
64	February 2006
156	January 2006
179	December 2005
111	November 2005
196	October 2005
122	September 2005
80	August 2005
121	July 2005
195	June 2005
175	May 2005
88	April 2005
179	March 2005
181	February 2005
253	January 2005
152	December 2004
239	November 2004
289	October 2004
256	September 2004
214	August 2004
94	July 2004
204	June 2004
316	May 2004
225	April 2004
365	March 2004
99	February 2004
148	January 2004
61	December 2003
28	November 2003
137	October 2003
178	September 2003
165	August 2003
110	July 2003
67	June 2003
107	May 2003
69	April 2003
2667	March 2003
191	February 2003
125	January 2003
76	December 2002
30	November 2002
69	October 2002
263	September 2002
176	August 2002
344	July 2002
242	June 2002
344	May 2002
151	April 2002
17	March 2002
1	September 2001
258	August 2001
111	July 2001
266	June 2001
196	May 2001
123	April 2001
293	March 2001
149	February 2001
120	January 2001
163	December 2000
149	November 2000
73	October 2000
106	September 2000
29	August 2000
48	July 2000
69	June 2000
126	May 2000
158	April 2000
456	March 2000
55	February 2000
81	January 2000

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template