Use of memcmp in font.c

Use of memcmp in font.c

[Chong Yidong]

Is the use of memcmp in font.c:1384 safe?  It seems to me that if the
string being parsed ends early, we'll get a segmentation fault.

  /* Now parse ":KEY=VAL" patterns.  Store known keys and values in
     extra, copy unknown ones to COPY.  It is stored in extra slot by
     the key QCfc_unknown_spec.  */
  while (*p0)
    {
      Lisp_Object key, val;
      int prop;

      for (p1 = p0 + 1; *p1 && *p1 != '=' && *p1 != ':'; p1++);
      if (*p1 != '=')
	{
	  /* Must be an enumerated value.  */
	  val = font_intern_prop (p0 + 1, p1 - p0 - 1);
	  if (memcmp (p0 + 1, "light", 5) == 0
	      || memcmp (p0 + 1, "medium", 6) == 0
  .....

Re: Use of memcmp in font.c

[Kenichi Handa]

In article <87ve0iqnnq.fsf@stupidchicken.com>, Chong Yidong <cyd@stupidchicken.com> writes:

> Is the use of memcmp in font.c:1384 safe?  It seems to me that if the
> string being parsed ends early, we'll get a segmentation fault.

>   /* Now parse ":KEY=VAL" patterns.  Store known keys and values in
>      extra, copy unknown ones to COPY.  It is stored in extra slot by
>      the key QCfc_unknown_spec.  */
>   while (*p0)
>     {
>       Lisp_Object key, val;
>       int prop;

>       for (p1 = p0 + 1; *p1 && *p1 != '=' && *p1 != ':'; p1++);
>       if (*p1 != '=')
> 	{
> 	  /* Must be an enumerated value.  */
> 	  val = font_intern_prop (p0 + 1, p1 - p0 - 1);
> 	  if (memcmp (p0 + 1, "light", 5) == 0
> 	      || memcmp (p0 + 1, "medium", 6) == 0
>   .....

I've thought that memcmp doesn't check bytes after the first
non-matching byte and thus the above are safe because p0 is
null-terminated.

---
Kenichi Handa
handa@ni.aist.go.jp

Re: Use of memcmp in font.c

[Miles Bader]

Kenichi Handa <handa@m17n.org> writes:
> I've thought that memcmp doesn't check bytes after the first
> non-matching byte and thus the above are safe because p0 is
> null-terminated.

Probably many implementations don't, but I'm not sure that's
guaranteed...  [e.g., they may do comparisons more than one byte at a
time.]

-Miles

-- 
Fast, small, soon; pick any 2.