[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Bug-gnulib] getline bugfix submitted via findutils

From: Bruno Haible
Subject: Re: [Bug-gnulib] getline bugfix submitted via findutils
Date: Fri, 16 Apr 2004 22:39:21 +0200
User-agent: KMail/1.5

> The error does occur in the current released version (ie 4.1.7)

IMO the fix should go into the function that calls getstr() or getndelim2().

The getndelim2() function is meant to be used after the caller has already
stored OFFSET bytes on his own and wants to read further bytes into the same

With the patch that you gave, when OFFSET > *LINESIZE, the first realloc
call allocates OFFSET - *LINESIZE bytes with uninitialized memory. Does the
caller handle a string, consisting of N initialized bytes, followed
by OFFSET - N uninitialized bytes, followed by some initialized
bytes, correctly? No it doesn't. A look at findutils-4.1.7/locate/locate.c
line 322 reveals that, of course, it assumes that the whole line is
initialized data.

The real bug is in findutils-4.1.7/locate/locate.c line 320, the fact
that the 'count' read from the file is not verified in any way. If it is
not in bounds, 'locate' should give an error message saying "locatedb


reply via email to

[Prev in Thread] Current Thread [Next in Thread]