Re: still getting errors with CRM

On Wed, Apr 30, 2008 at 06:08:57PM -0600, David Morris wrote:
> 
> Looking at the code in the attached file, all loops on the
> string look like this:
> 
>     for (is = 0; is <= inlen ; is++)
> 
> Because the loop is <= (and it *should* be that rather than

sigh... I'll never learn to NOT consider as fixed once for all old bugs, 
and instead go re-check the code:

!To: [email protected]
!From: Barry Jaspan <bjaspan-4uwKKfrde/[email protected]>
!Date: Mon, 06 Feb 2006 18:31:58 -0500
!Subject: [Crm114-general] memory bug in BlameTheReavers
!Message-Id: <7.0.1.0.2.20060206183154.026f6238-VNLtg3xAQEMdnm+yROfE0A@public.gmane.org>
!
!Purify on Windows reports an uninitialized memory read at
!crm_expandvar.c:168 in BlameTheReavers, the last line of this excerpt:
!
!      for (is = 0; is <= inlen ; is++)
!        {
!          if (buf[is] != '\\' )
!
!The problem is pretty clearly an off-by-one error.  inlen is the
...

!From: "Eric S. Johansson" <[email protected]>
!To: [email protected]
!Subject: Re: [Crm114-general] memory bug in BlameTheReavers
!Date: Tue, 07 Feb 2006 10:04:17 -0500
!
!Bill Y wrote:
!>Yep.  Send me a patch and I will vet and put it in.
!
!mmm sounds like the next release will be Reavers II: second breakfast

seems the patch/fix didn't make it into mainline. Those like me who
didn't bother to check (mainline, my local codebase does HAVE a fix) are
to blame :(.

But, note that's not like char buf[inlen]; the length limit is set by maxlen,
buffers get reallocated etc. Off-by-one didn't necessarily mean segv, but out
of var-value bound, yet still in-buffer. Maybe :}.

-- 
paolo

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone