Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant implementation imp ose length constraints?

From: "McDonald, Ira" <[email-masked]>
Date: Wed, 1 Jun 2005 08:51:19 -0700

Hi,

I support Randy's suggested update to Security Considerations too.

I still think it would be good to specify a lower bound of length
for language tags that SHOULD be supported by conforming implementations.
Because in the RFC3066bis real-world language tags may very well be much
longer than the classic 'll-CC'.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of Doug Ewell
> Sent: Tuesday, May 31, 2005 11:50 PM
> To: LTRU Working Group
> Subject: [Ltru] Re: [psg.com #944] MAY a conformant implementation
> impose length constraints?
> 
> 
> Randy Presuhn <randy underscore presuhn at mindspring dot com> wrote:
> 
> >> Won't work: Variants and private use subtags are not bounded in
> >> number. Neither can extension lengths be known in advance.
> >
> > Then I think we really need to add something like the 
> following to the
> > security considerations section, as part of this issue's 
> resolution /
> > rejection:
> >
> > Since there is no limit to the number of variant and private use
> > subtags, and consequently no limit on the possible length of a tag,
> > implementations need to guard against buffer overflow attacks.  See
> > section ## for details on tag truncation, which can occur as a
> > consequence of defenses against buffer overflow.
> 
> Yes.  Excellent.
> 
> --
> Doug Ewell
> Fullerton, California
> http://users.adelphia.net/~dewell/
> 
> 
> 
> _______________________________________________
> Ltru mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ltru
> 

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru