Re: SecFix for databases/firebird, please review

--KsSkVHHhotaZRe1D
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 18, 2003 at 11:59:28AM +0200, Alexander Leidinger wrote:
+> Thanks for the review. I've updated
+> http://www.leidinger.net/FreeBSD/firebird-1.0.2-secfix.tar.bz2 (modulo
+> Chris' work in progress). I'm looking forward to the next round. :-)

IMHO there are still problems with strncat(3).

If you use something like that:

	strncat(buf, string, sizeof(buf) - 1);

why not just use:

	strncpy(buf, string, sizeof(buf) - 1);

because correct form is:

	strncat(buf, string, sizeof(buf) - strlen(buf) - 1);

There is also syntax error here:

	strncat (ib_prefix_msg_val, MAXPATHLEN, ib_prefix_msg);

You also still don't add:

	buf[sizeof(buf) - 1] =3D '\0';

after all strncat(3)s.

This was in first patch:)

IMHO if you want to keep portability, just add some BSD-licensed strlcat(3)
and strlcpy(3) implementations to firebird's code and use it, because
strncat(3) is really fucked up.

--=20
Pawel Jakub Dawidek                       [email protected]
UNIX Systems Programmer/Administrator     http://garage.freebsd.pl
Am I Evil? Yes, I Am!                     http://cerber.sourceforge.net

--KsSkVHHhotaZRe1D
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iQCVAwUBP0xnfD/PhmMH/Mf1AQFblwP/f0mPHHbFiO9eRmJm1sjxNdurH9p0zFCY
gjQWrssTFCjhgYdfGWjFX/HGrloWavwPLNikCHUFmT/Z3FhEZBwHIs5BlkeMgtJu
q1IG5OA8AvLg28pIeJpYl4WqJPAsxjfdqTaIV3izecTCu90ti273X/H40ket2F4I
2FbbXvQtOuw=
=jzMA
-----END PGP SIGNATURE-----

--KsSkVHHhotaZRe1D--