RE: [reSIProcate] Timer vulnerability
I think it would be better to add some relative time functions to Timer and
have the timers use these, instead of redefining getSystemTime(). I was
considering do this a while back - but the consensus was to not worry about
it. Looks like you found another reason to do it - so maybe it's time! : )
Do Unix OSs have a function similar to GetTickCount()?
-----Original Message-----
From: Kenneth Ho [mailto:kenho@xxxxxxxxxxxxxx]
Sent: Monday, April 04, 2005 2:16 AM
To: resiprocate-devel@xxxxxxxxxxxxxxxxxxx
Subject: [reSIProcate] Timer vulnerability
We are experiencing users hacking our client software on windows. They
do so by manipulating windows system time. Which causes timers to be
fired prematurely and incur undesired behavior in the stack.
As a counter to these hacks, I plan to change Timer::getSystemTime() to
use GetTickCount() instead of GetSystemTime() for windows. The drawbacks
are:
1. The value returned would have less precision. From 1/million second
to 1/thousand second, but remain the same unit (1/million second). Which
should not be a big deal, at least on Windows anyhow.
2. The value returned would not be associated to calendar time anymore.
This worries me somewhat, I am not sure if anyone uses this function in
such a way.
Ken
_______________________________________________
resiprocate-devel mailing list
resiprocate-devel@xxxxxxxxxxxxxxxxxxx
https://list.sipfoundry.org/mailman/listinfo/resiprocate-devel