From: Gregor Hoffleit <gregor@hoffleit.de>
To: David Edmondson <dme@dme.org>
Cc: notmuch <notmuch@notmuchmail.org>
Subject: Re: [PATCH] format_part_json: part_content->data is not null terminated
Date: Thu, 01 Apr 2010 14:05:47 +0200 [thread overview]
Message-ID: <1270123286-sup-8763@sam.mediasupervision.de> (raw)
In-Reply-To: <87634bjsrl.fsf@ut.hh.sledj.net>
Both of you Davids are indeed completely right. Even more since the
next command in the patch after memcpy zeroes that byte.
This is how it's meant to be:
+ content_data = talloc_size (ctx, part_content->len+1);
+ memcpy (content_data, (char *)part_content->data, part_content->len);
+ content_data[part_content->len] = 0;
Should I submit a fixed patch?
Mea culpa,
Gregor
* David Edmondson <dme@dme.org> [Do Apr 01 13:50:54 +0200 2010]
> On Thu, 01 Apr 2010 08:40:37 -0300, David Bremner <david@tethera.net> wrote:
> > On Thu, 04 Mar 2010 11:49:48 +0100, Gregor Hoffleit <gregor@hoffleit.de> wrote:
> > > In format_part_json, part_content->data is not a null terminated
> > > string.
> >
> > I'd like to see this bug fixed,
>
> +1.
>
> > and the patch is pretty small, but...
> >
> > > Instead, we have to use part_content->len.
> > > + content_data = talloc_size (ctx, part_content->len+1);
> > > + memcpy (content_data, (char *)part_content->data, part_content->len+1);
> >
> > Can anyone explain why we copy (what seems to me to be) one extra byte
> > here? In principle reading outside our allocated memory could cause
> > problems; at minimum it makes a false positive for a memory checker like
> > valgrind.
>
> Agreed. It looks as though this should copy only part_content->len bytes.
>
> dme.
--
Gregor Hoffleit <gregor.hoffleit@mediasupervision.de>
Media Supervision Software Consulting GmbH
Georg-Friedrich-Haendel-Str. 13, 69214 Eppelheim/Heidelberg
Tel: +49 6221 705079-22 / Fax: +49 6221 705079-80
Amtsgericht Mannheim, HRB 336821, Geschäftsführer Reinhard Kratzke
http://www.mediasupervision.de/
prev parent reply other threads:[~2010-04-01 12:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-04 10:49 [PATCH] format_part_json: part_content->data is not null terminated Gregor Hoffleit
2010-04-01 11:40 ` David Bremner
2010-04-01 11:50 ` David Edmondson
2010-04-01 12:05 ` Michal Sojka
2010-04-05 9:36 ` David Edmondson
2010-04-05 18:00 ` Carl Worth
2010-04-01 12:05 ` Gregor Hoffleit [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1270123286-sup-8763@sam.mediasupervision.de \
--to=gregor@hoffleit.de \
--cc=dme@dme.org \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).