Re: trunk r11017: Avoid a lot of bufer overruns in ext_edirectory_userip_acl

On 11/05/2010 06:47 AM, Amos Jeffries wrote:
> ------------------------------------------------------------
> revno: 11017
> committer: Amos Jeffries<squid3_at_treenet.co.nz>
> branch nick: trunk

> - xstrncpy(prog, EDUI_PROGRAM_NAME, sizeof(prog));
> + xstrncpy(prog, EDUI_PROGRAM_NAME, strlen(EDUI_PROGRAM_NAME));

> - xstrncpy(prog, edui_conf.program, sizeof(prog));
> + xstrncpy(prog, edui_conf.program, strlen(edui_conf.program));

> - xstrncpy(cbuf, prog, sizeof(cbuf));
> + xstrncpy(cbuf, prog, strlen(prog));

...

These and probably other changes in this commit look like bugs to me:
The third argument to xstrncpy() should be the destination buffer size,
not the source string length. The string length is usually irrelevant
because xstrncpy() will not copy past the 0-terminator of the source string.

BTW, the following code (which was not changed by this commit), appears
to be buggy or weird and should be changed to use cbuf buffer size, not
cbuf string length:

> memset(cbuf, '\0', strlen(cbuf));

HTH,

Alex.
Received on Mon Nov 08 2010 - 21:44:22 MST