[commit] objc-lang.c, classes_info, avoid string overrun

[commit] objc-lang.c, classes_info, avoid string overrun

[Michael Snyder]

[-- Attachment #1: Type: text/plain, Size: 87 bytes --]

This is the same problem as with selectors_info, so I just applied
the same solution.


[-- Attachment #2: overflow1.txt --]
[-- Type: text/plain, Size: 1213 bytes --]

2011-02-28  Michael Snyder  <msnyder@vmware.com>

	* objc-lang.c (selectors_info): Add a small safety margin to 
	avoid overflow.
	(classes_info): Error out on too long REGEXP.

Index: objc-lang.c
===================================================================
RCS file: /cvs/src/src/gdb/objc-lang.c,v
retrieving revision 1.93
diff -u -p -u -p -r1.93 objc-lang.c
--- objc-lang.c	28 Feb 2011 18:14:34 -0000	1.93
+++ objc-lang.c	1 Mar 2011 01:41:39 -0000
@@ -720,7 +720,7 @@ selectors_info (char *regexp, int from_t
 	strcpy(myregexp, ".*]");
       else
 	{
-	  if (sizeof (myregexp) < strlen (regexp) + 1)
+	  if (sizeof (myregexp) < strlen (regexp) + 4)
 	    error (_("Regexp is too long: %s"), regexp);
 	  strcpy(myregexp, regexp);
 	  if (myregexp[strlen(myregexp) - 1] == '$') /* end of selector */
@@ -863,6 +863,8 @@ classes_info (char *regexp, int from_tty
     strcpy(myregexp, ".* ");	/* Null input: match all objc classes.  */
   else
     {
+      if (sizeof (myregexp) < strlen (regexp) + 4)
+	error (_("Regexp is too long: %s"), regexp);
       strcpy(myregexp, regexp);
       if (myregexp[strlen(myregexp) - 1] == '$')
 	/* In the method name, the end of the class name is marked by ' '.  */

Re: [commit] objc-lang.c, classes_info, avoid string overrun

[Yao Qi]

On 03/01/2011 09:46 AM, Michael Snyder wrote:
> -	  if (sizeof (myregexp) < strlen (regexp) + 1)
> +	  if (sizeof (myregexp) < strlen (regexp) + 4)
>  	    error (_("Regexp is too long: %s"), regexp);
>  	  strcpy(myregexp, regexp);

It is a little bit confusing when people read this code.  We may need a
short comment here.

-- 
Yao (齐尧)

Re: [commit] objc-lang.c, classes_info, avoid string overrun

[Michael Snyder]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

Yao Qi wrote:
> On 03/01/2011 09:46 AM, Michael Snyder wrote:
>> -	  if (sizeof (myregexp) < strlen (regexp) + 1)
>> +	  if (sizeof (myregexp) < strlen (regexp) + 4)
>>  	    error (_("Regexp is too long: %s"), regexp);
>>  	  strcpy(myregexp, regexp);
> 
> It is a little bit confusing when people read this code.  We may need a
> short comment here.
> 

Okey dokey, see attached.




[-- Attachment #2: comment.txt --]
[-- Type: text/plain, Size: 1057 bytes --]

2011-03-01  Michael Snyder  <msnyder@vmware.com>

	* objc-lang.c (selectors_info): Add explanitory comment.
	(classes_info): Ditto.

Index: objc-lang.c
===================================================================
RCS file: /cvs/src/src/gdb/objc-lang.c,v
retrieving revision 1.94
diff -u -p -u -p -r1.94 objc-lang.c
--- objc-lang.c	1 Mar 2011 01:44:24 -0000	1.94
+++ objc-lang.c	1 Mar 2011 18:49:41 -0000
@@ -720,6 +720,7 @@ selectors_info (char *regexp, int from_t
 	strcpy(myregexp, ".*]");
       else
 	{
+	  /* Allow a few extra bytes because of the strcat below.  */
 	  if (sizeof (myregexp) < strlen (regexp) + 4)
 	    error (_("Regexp is too long: %s"), regexp);
 	  strcpy(myregexp, regexp);
@@ -863,6 +864,7 @@ classes_info (char *regexp, int from_tty
     strcpy(myregexp, ".* ");	/* Null input: match all objc classes.  */
   else
     {
+      /* Allow a few extra bytes because of the strcat below.  */
       if (sizeof (myregexp) < strlen (regexp) + 4)
 	error (_("Regexp is too long: %s"), regexp);
       strcpy(myregexp, regexp);

Re: [commit] objc-lang.c, classes_info, avoid string overrun

[Tom Tromey]

>>>>> "Michael" == Michael Snyder <msnyder@vmware.com> writes:

Michael> 2011-02-28  Michael Snyder  <msnyder@vmware.com>
Michael> 	* objc-lang.c (selectors_info): Add a small safety margin to 
Michael> 	avoid overflow.
Michael> 	(classes_info): Error out on too long REGEXP.

I don't really mind this kind of cleanup, but it seems like it would
simpler to just fix the underlying bug entirely, say by using malloc and
a cleanup.

Tom