what actually uses xdr_mem.c?

D J Hawkey Jr hawkeyd at visi.com
Wed Mar 26 12:10:45 PST 2003


On Mar 26, at 11:20 AM, Simon Barner wrote:
> 
> Hi Jeremy,
> 
> > The recent XDR fixes the xdrmem_getlong_aligned(),
> > xdrmem_putlong_aligned(), xdrmem_getlong_unaligned(),
> > xdrmem_putlong_unaligned(), xdrmem_getbytes(), and/or xdrmem_putbytes()
> > functions, but it is difficult to know what uses these (going backwards
> > manually).
> 
> I would not rely on the binaries to find out, which programs make use of the
> above functions. That's one of the advantages of an open source os ;-)
> 
> Something like
> 
>    cd /usr/src
>    grep -rl 'xdrmem_getlong_aligned' *
> 
> will print all the files that contain the string 'xdrmem_getlong_aligned'. Based
> on the path name of those file, you will be able to find out which programs use
> the xdr* functions.

Actually, I _would_ check the binaries. Scanning /usr/src doesn't cover
anything installed via the ports collection (/usr/ports), from other
sources, or "home-grown" software.

A week or so ago, I posted a command that scans the binaries:

    find $DIR -type f \
        |xargs readelf -a 2>/dev/null \
        |awk '/^File:/ { name = $2; printed = 0; } \
          /XDR|xdr/ { if (!printed) { print name; printed = 1; } }' \
        |xargs ldd 2>/dev/null

If it reports a pathed file without listing any shared libraries, then
it is statically-linked.

I can't say this is the definitive answer, but it worked in a controlled
environment (i.e., known binaries), as well as a live system. You can
break down it's components to see what each pipe does.

> HTH,
>  Simon

HTH too,
Dave

-- 
  ______________________                         ______________________
  \__________________   \    D. J. HAWKEY JR.   /   __________________/
     \________________/\     hawkeyd at visi.com    /\________________/
                      http://www.visi.com/~hawkeyd/



More information about the freebsd-security mailing list