Re: [computer-go] how to use GTP in place of GMP

[Peter Paul Elfferich <pp@xxxxxxxxxx>]

Quoting "Compgo123@xxxxxxxxxxxxxxxxx" <Compgo123@xxxxxxxxxxxxxxxxx>:
> I have one question. Does GTP pose any potential security problem in anyway?

I'd say so. All programs are processing data which has been received over a
network. If either the network or the program on the other side is
untrustworthy this is risky.

For example a program could theoretically try to create a buffer overflow error
in a computer go program by sending some suitable gtp command with a big amount
of data. These kind of errors could thereafter theoretically be used again to
get full user (shell) access to the system.

So, as with all I/O handling: verify all input to be correct or at least specify
upper limits to the amount of data to be processed!

Greetings,

PP

PS: this risk is somewhat limited if the go program is running in a java sandbox

_______________________________________________
computer-go mailing list
computer-go@xxxxxxxxxxxxxxxxx
http://www.computer-go.org/mailman/listinfo/computer-go/