[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Fwd: [e-lang] Protocol implementation errors

• To: Alessandro Triglia <sandro@m...>
• Subject: Re: Fwd: [e-lang] Protocol implementation errors
• From: Rich Salz <rsalz@d...>
• Date: Fri, 03 Oct 2003 14:56:12 -0400
• Cc: xml-dev@l...
• In-reply-to: <002101c389dd$c024a2b0$8b01a8c0@aldebaran>
• References: <002101c389dd$c024a2b0$8b01a8c0@aldebaran>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

> After over 18 months
> of close scrutiny, no one has been able to report any architectural flaw in
> either the ASN.1 notation or any of the standard encoding rules, which might
> have increased the risk of program misbehavior.  The standards are innocent.

That's a pretty broad claim to make, and I'm not so sure I'd go along 
with that.  I could imagine playing some interesting games with 
indefinite-form length (or tag) values that get something "interesting" 
to happen because they cause wrap-around or (for lengths) make the 
system consume gobs of memory, hang in a network read waiting for the 
infinite data that will never come, etc.  Did the scrutinizers think of 
those things?

In my experience, fixing "too long" errors for XML parsers has to happen 
  in only one place.  Fixing them for ASN.1/[BDP]ER parsers requires 
fixing it every time you nest a structure or list.
	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • RE: Fwd: [e-lang] Protocol implementation errors
    • From: "Alessandro Triglia" <sandro@m...>

• References:
  • RE: Fwd: [e-lang] Protocol implementation errors
    • From: "Alessandro Triglia" <sandro@m...>

• Prev by Date: RE: Fwd: [e-lang] Protocol implementation errors
• Next by Date: Re: Fwd: [e-lang] Protocol implementation errors
• Previous by thread: RE: Fwd: [e-lang] Protocol implementation errors
• Next by thread: RE: Fwd: [e-lang] Protocol implementation errors
• Index(es):
  • Date
  • Thread