patchSimulavr: an AVR simulator - Patches: patch #7078, fix potential string overflows in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #7078: fix potential string overflows in 0.1.2.6

Submitted by:  Juergen Weigert <jnweiger>
Submitted on:  Sun 31 Jan 2010 12:19:33 PM UTC
 
Category:  None Priority:  5 - Normal
Status:  Wont Do Privacy:  Public
Assigned to:  None Open/Closed:  Closed
Component Version:  * simulavr
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Sun 31 Jan 2010 11:39:22 PM UTC, comment #2: 

Yes, you did it right. I only went after the obvious. Sorry.

strncat() should not be used anyway. It was designed to fool the user. Nobody would assume that POSIX blessed an interface where both caller and function would need to count the bytes.

Juergen Weigert <jnweiger>
Sun 31 Jan 2010 12:41:29 PM UTC, comment #1: 

Nice catch. (Oh those pesky C string functions. How difficult to get right. And how boring.)

However the strncat() copies the specified number of bytes plus NUL byte. See wikipedia http://en.wikipedia.org/wiki/Strcat#strncat
"Common mistakes are..."
In the original patch it overwrites one byte. This new one does not, I hope.

(file #19585)

Petr Hluzin <petrh>
Project Member
Sun 31 Jan 2010 12:19:33 PM UTC, original submission:  

I've compiled with latest gcc-4.4.1 and at extra mean warning levels. This is what I found:

old style flex output must be pampered with to allow ignoring returnvalue of fwrite().
strncat() third parameter must be remaining size in buffer, not total size().

Juergen Weigert <jnweiger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #19585:  happy_gcc_v2.patch added by petrh (2KiB - text/x-diff - file #19581 + fixed 1B overwrite)
file #19581:  happy_gcc.patch added by jnweiger (2KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tomk (Updated the item)
  • -email is unavailable- added by petrh (Updated the item)
  • -email is unavailable- added by jnweiger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-10-25 tomk StatusNone => Wont Do
        Open/ClosedOpen => Closed
    2010-01-31 petrh Attached File- => Added happy_gcc_v2.patch, #19585
    2010-01-31 jnweiger Attached File- => Added happy_gcc.patch, #19581

    Back to the top


    Powered by Savane 3.9