Re: [PATCH] PR 16286: Reading python value as string beyond declared size

[Doug Evans <dje@google.com>]

Pedro Alves writes:
 > On 12/03/2013 11:01 PM, Doug Evans wrote:
 > > On Tue, Dec 3, 2013 at 12:29 PM, Pedro Alves <palves@redhat.com> wrote:
 > >> On 12/02/2013 11:14 PM, Doug Evans wrote:
 > >>> +      if (*length > 0)
 > >>> +     fetchlimit = UINT_MAX;
 > >>
 > >> Shouldn't this be:
 > >>
 > >>       if (*length > 0)
 > >>         fetchlimit = *length;
 > >>
 > >> ?  That is, if the caller specified a limit, why do we do over it?
 > > 
 > > read_string will take min (len, fetchlimit), and I saw no value in
 > > passing fetchlimit = *length.
 > 
 > Ah, I see now.  Thanks.

Thanks.  Committed.

 > >> BTW, it looks like the not_lval/lval_internalvar path can
 > >> blindly read beyond the value's contents buffer, if *length
 > >> is bigger than the value's contents buffer size:
 > > It didn't look right to me either, but I was leaving digging deeper
 > > for another pass.
 > 
 > OK.  TBC, I wasn't requesting that'd be fixed in this patch, only
 > for confirmation that I wasn't missing something.

I filed https://sourceware.org/bugzilla/show_bug.cgi?id=16313