NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

lib/49185: strvisx: Handle zero-length input strings gracefully.



>Number:         49185
>Category:       lib
>Synopsis:       strvisx: Handle zero-length input strings gracefully.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 08 16:20:00 +0000 2014
>Originator:     Conrad Meyer
>Release:        FreeBSD CURRENT / NetBSD CVS HEAD
>Organization:
EMC / Isilon storage division
>Environment:
FreeBSD cemvbox9993 11.0-RELEASE FreeBSD 11.0-RELEASE amd64

>Description:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193447

The internal istrsenvisx() routine overloaded the zero length value as a
sentinel for "use strlen(3)." This is bad because the zero-length source string
has a defined behavior and the pointer for a zero-length string may be
completely bogus. Calling strlen(3) on a bogus pointer is bad.

Instead, use ssize_t for the input string length and use a #defined constant
MB_STRZ == (-1) as the sentinel for the nul-terminated strvis variants (strvis,
etc).

>How-To-Repeat:
Call strvisx() on a zero length input string.
>Fix:
See patch in comment 0 here: 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193447



Home | Main Index | Thread Index | Old Index