Re: [PATCH] PR 16286: Reading python value as string beyond declared size

Pedro Alves
2013-12-04T11:47:53Z

On 12/03/2013 11:01 PM, Doug Evans wrote:
> On Tue, Dec 3, 2013 at 12:29 PM, Pedro Alves <palves@redhat.com> wrote:
>> On 12/02/2013 11:14 PM, Doug Evans wrote:
>>> + if (*length > 0)
>>> + fetchlimit = UINT_MAX;
>>
>> Shouldn't this be:
>>
>> if (*length > 0)
>> fetchlimit = *length;
>>
>> ? That is, if the caller specified a limit, why do we do over it?
>
> read_string will take min (len, fetchlimit), and I saw no value in
> passing fetchlimit = *length.

Ah, I see now. Thanks.

>> BTW, it looks like the not_lval/lval_internalvar path can
>> blindly read beyond the value's contents buffer, if *length
>> is bigger than the value's contents buffer size:
> It didn't look right to me either, but I was leaving digging deeper
> for another pass.

OK. TBC, I wasn't requesting that'd be fixed in this patch, only
for confirmation that I wasn't missing something.

--
Pedro Alves