Re: [PATCH]out of bounds read error in courier-authlib / userdb_get()
Hanno Böck <[email protected]>
| Newsgroups | gmane.mail.imap.courier.general |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 28 Jan 2024 08:37:53 -0500 Sam Varshavchik <[email protected]> wrote: > I checked several references if it is specified that memcmp > may or may not actually read the memory being compared after the > first differing value. They're silent on the subject, it doesn't look > like it's specified. Various answers on Stackoverflow claim that it > can, but they don't really site anything authoritative. Here's a blogpost that investigates this exact issue in detail: https://trust-in-soft.com/blog/2015/12/21/memcmp-requires-pointers-to-fully-valid-buffers/ Short summar is that the C standard is not super-clear, but it seems to imply that memcmp needs fully valid buffers, and that there can be real situations in which an overread will cause a segfault if it ends up in another memory page. -- Hanno Böck https://hboeck.de/ _______________________________________________ courier-users mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users