Re: [PATCH]out of bounds read error in courier-authlib / userdb_get()

Hanno Böck writes:

> The relevant piece of code:
> 		if (memcmp(u, n, nl) == 0 &&
>
> The memcmp compares u and n up to the length of n, but it is not
> guaranteed that u is actually long enough. I believe this can easily be
> fixed by replacing memcmp with strncmp, as u points to a
> null-terminated string and strncmp guarantees that the comparison ends
> with a null terminator.

u is null terminated. n is guaranteed not to have any null characters in its  
first nl bytes. memcmp is specified as having its return value set by the  
first differing byte in the compared memory blocks.

So, it is guaranteed that everything past the first null byte in u gets  
ignored, because the null byte will be the first differing value. I checked  
several references if it is specified that memcmp may or may not actually  
read the memory being compared after the first differing value. They're  
silent on the subject, it doesn't look like it's specified. Various answers  
on Stackoverflow claim that it can, but they don't really site anything  
authoritative. This is more of a curiosity, than anything else. I'll make  
this change, but there's no practical issue here, of any concern.

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQRupkKLJP96aW75pIOKYPgoojZS4gUCZbZYsQAKCRCKYPgoojZS
4uW+AP9SokzOuxyflO+eHI0Za1o2PSycaFfwQkFxZjnTL4FtmAD/YajC1uzTfzMw
xNJDbsrJAbiCYESy546hDgR5PrvkXAQ=
=3pf/
-----END PGP SIGNATURE-----