git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Another memory overrun in http-push.c

From
Junio C Hamano <junkio@cox.net>
Date
Mar 2, 2007, 08:16 UTC
Message-ID
<7vwt20giw3.fsf@assigned-by-dhcp.cox.net>
In-Reply-To
<20070301160911.GU57456@codelabs.ru>
Eygene Ryabinkin <rea-git@codelabs.ru> writes:
Show 10 quoted lines
> Me again ;))
>
> Spotted another memory overrun in the http-push.c. In principle,
> it is the read-only overrun, but it provokes the coredump on my
> system.  The problem is that strlcpy(dst, src, size) returns the
> length of the 'src' and demands it to be NULL-terminated (see
> 'man strlcpy' and http://www.gratisoft.us/todd/papers/strlcpy.html).
> It is not the case for the xml_cdata and possibly other places. So
> I've just replaced strlcpy with memcpy + zero termination all over
> the http-push.c. The patch is below.
Please check Documentation/SubmittingPatches.

Use of strlcpy() in general _is_ stupid if you are computing how much space is needed, allocating that much as your own buffer and then copying. strlcpy() needs to say how much it would have copied if it were given large enough buffer, and it needs to be able to run strlen(src), so it is not valid to give a buffer that may not be NUL-terminated as you say.

Previous: Eygene RyabinkinNext: Eygene Ryabinkin
Message 2 of 3 in “Another memory overrun in http-push.c”
  1. Eygene RyabinkinMar 1, 2007
  2. Junio C HamanoMar 2, 2007
  3. Eygene RyabinkinMar 2, 2007

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.