Gentoo Archives: gentoo-user

From: Richard Fish <bigfish@××××××××××.org>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] BUG in glibc???? [WAY OT]
Date: Sun, 30 Oct 2005 23:46:16
Message-Id: 43655814.3080008@asmallpond.org
In Reply to: [gentoo-user] BUG in glibc???? by capsel
1 capsel wrote:
2
3 >Hi all,
4 >
5 >is it a bug in glibc or in my code?
6 >
7 >
8
9 This is so far off topic, it isn't even funny. But, I see a couple bugs
10 in your code. I will cover them inline:
11
12 > if( ( config_content == NULL ) || ( config_content==0 ) )
13 >
14 >
15
16 Not really a bug here, but since NULL and 0 are the same value, you only
17 need one side of the comparison.
18
19 > *(lines) = config_content;
20 > for( i = 0; i < config_contentl; i++ )
21 > {
22 > if( *(config_content+i) == '\n' )
23 > {
24 > lines = (char**) realloc( lines, sizeof( char** )*(linesc+1) );
25 > if( lines == NULL )
26 > {
27 > fprintf( logi, "=> B³±d alokacji\n" );
28 > return 0;
29 > }
30 > linesc++;
31 > *(lines+linesc) = (config_content+i+1);
32 > *(config_content+i) = '\0';
33 > printf( "-> linesc++\n" );
34 > }
35 > }
36 >
37 >
38
39 There is a possible off-by-one error for linesc if config_content does
40 not end with a newline. For example, consider a config file with a
41 single line that does not end with a newline. In that case, linesc will
42 be 0 in your code, and you will not process anything.
43
44 I suggest setting linesc = 1 before the loop, and then adjust the
45 internals appropriately.
46
47 > fprintf( stdout, "-> linesc = %u\n", linesc );
48 > for( i = 0; i < linesc; i++ )
49 > {
50 > if( *(*(lines+i)) == '#' )
51 > {
52 > continue;
53 > }
54 >
55 >
56
57 Again, not a bug, but a readability recommendation. Use a temporary
58 variable inside your loop for the current line:
59
60 char* line = lines[i];
61
62 Then replace all "*(lines+i)" with "line".
63
64 > if( strcmp( "log", *(lines+i) ) == 0 )
65 > {
66 > config_configpathl = strlen( eqch+1 );
67 > config_configpath = (char*) malloc( config_configpathl );
68 > if( config_configpath == NULL )
69 > {
70 > fprintf( logi, "=> B³±d alokacji pamiêci na nazwe pliku loga dla linii %i\n",i );
71 > free( lines );
72 > return 0;
73 > }
74 > strcpy( config_configpath, eqch+1 );
75 > fprintf( stdout, "-> log = `%s'\n", eqch+1 );
76 > continue;
77 > }
78 >
79 >
80
81 This is your major bug, a memory overflow. You are only allocated
82 enough memory for the characters of the string, not including the
83 terminating null character. Strcpy copies the characters of the string,
84 _plus_ the terminating null, which is where you get a memory overflow.
85
86 Get rid of config_configpathl and the strlen line, and replace the
87 malloc and strcpy with strdup().
88
89 -Richard
90
91 --
92 gentoo-user@g.o mailing list