Comments (7)
rustyrussell
commented on August 22, 2024
Russ Dill <[email protected]> writes:
When path_join is called with path_join(NULL, "", "foo"), the code reads 1 byte before the allocated return buffer:
51 len = strlen(base);
52 ret = tal_dup_arr(ctx, char, base, len, 1 + strlen(a) + 1);
53 if (!ret)
54 goto out;
55 if (ret[len-1] != PATH_SEP)
56 ret[len++] = PATH_SEP;
When len is 0, ret[len-1] reads 1 byte before the allocated return buffer.
Hmm, I was assuming base was actually a path, not "".
Because you *don't* want "/foo" in this case, you presumably want "foo"?
Cheers,
Rusty.
from ccan.
russdill
commented on August 22, 2024
Probably just "foo", anything is probably fine though so long as it's documented as not being supported but still avoids the outside of buffer access if it gets one.
from ccan.
gitgofred
commented on August 22, 2024
greetings and salutations!
51 len = strlen(base);
// how about
if(0 == len)
goto out;
52 ret = tal_dup_arr(ctx, char, base, len, 1 + strlen(a) + 1);
// and this to negate any side effects
53 if (0 == len | !ret)
54 goto out;
55 if (ret[len-1] != PATH_SEP)
56 ret[len++] = PATH_SEP;
from ccan.
gitgofred
commented on August 22, 2024
ln 53 chg not req
from ccan.
gitgofred
commented on August 22, 2024
perhaps a sort of unlikely_path to eye any off by one before ret = tal_dup_arr(...)?
from ccan.
gitgofred
commented on August 22, 2024
53 comment logic and if (0 -- len) not useful on second parse.
from ccan.
gitgofred
commented on August 22, 2024
nice stitch.
…On 12/21/17 4:47 PM, ccan-maintainers wrote:
Closed #61 <#61> via
118708e
<118708e>.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#61 (comment)>, or
mute the thread
<https://github.com/notifications/unsubscribe-auth/AhHOT4zAkq7jHD2fayzscBYitW_pjaCPks5tCu4kgaJpZM4QPk5V>.
from ccan.
Related Issues (20)
- Strange content on the web site that does not seem to be present in github HOT 6
- What tool should I use to generate function documentation?
- base64 build errors on big endian BSD HOT 7
- Build assertion against conditions which cannot be evaluated.
- gcc13 error: '_170' may be used uninitialized HOT 1
- `tal_strdup(ctx, NULL)` returns uninitialized string
- `tal_strndup(ctx, NULL, 1)` breaks contract
- Non-conforming Isaac64 PRNG HOT 1
- SIGBUS on OpenBSD sparc64
- Spam URL on http://ccodearchive.net/ HOT 2
- multiple definition of `_asort' - on musl libc HOT 10
- endian compilation issues on Alpine Linux HOT 4
- JSON parser test failures HOT 1
- What does the licence name 'BSD-MIT' name? HOT 1
- JSON library doesn't work with locales that use comma as decimal separator
- bitmap doesn't work on 32bit x86/ARM HOT 2
- ccan: make check log from armv7l
- #define 'HAVE_UNALIGNED_ACCESS' and [-Wcast-align] warnings on 32bit armv7l HOT 3
- Requesting versioned snapshots HOT 7
- generator.h: Generators require coroutines HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ccan.