* Strings encoding
@ 2016-03-22 7:44 Lev Stipakov
2016-03-22 13:46 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Lev Stipakov @ 2016-03-22 7:44 UTC (permalink / raw)
To: linux-audit
Hello,
The string values can be either enclosed in quotation marks or
hex-encoded. Is it safe to assume that sequence of bytes after hex
decoding is always utf-8 encoded string?
-Lev
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Strings encoding
2016-03-22 7:44 Strings encoding Lev Stipakov
@ 2016-03-22 13:46 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2016-03-22 13:46 UTC (permalink / raw)
To: linux-audit
Hello,
On Tuesday, March 22, 2016 09:44:19 AM Lev Stipakov wrote:
> The string values can be either enclosed in quotation marks or
> hex-encoded. Is it safe to assume that sequence of bytes after hex
> decoding is always utf-8 encoded string?
There are no guarantees what they are. This is used whenever the user could
have controlled the input in a way to trick the audit parser. And in one case
the hex encoding is an actual socket address structure.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-03-22 13:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-03-22 7:44 Strings encoding Lev Stipakov
2016-03-22 13:46 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox