Re: [PATCH] PR 16286: Reading python value as string beyond declared size

Doug Evans
2013-12-11T00:25:07Z

Pedro Alves writes:
> On 12/03/2013 11:01 PM, Doug Evans wrote:
> > On Tue, Dec 3, 2013 at 12:29 PM, Pedro Alves <palves@redhat.com> wrote:
> >> On 12/02/2013 11:14 PM, Doug Evans wrote:
> >>> + if (*length > 0)
> >>> + fetchlimit = UINT_MAX;
> >>
> >> Shouldn't this be:
> >>
> >> if (*length > 0)
> >> fetchlimit = *length;
> >>
> >> ? That is, if the caller specified a limit, why do we do over it?
> >
> > read_string will take min (len, fetchlimit), and I saw no value in
> > passing fetchlimit = *length.
>
> Ah, I see now. Thanks.

Thanks. Committed.

> >> BTW, it looks like the not_lval/lval_internalvar path can
> >> blindly read beyond the value's contents buffer, if *length
> >> is bigger than the value's contents buffer size:
> > It didn't look right to me either, but I was leaving digging deeper
> > for another pass.
>
> OK. TBC, I wasn't requesting that'd be fixed in this patch, only
> for confirmation that I wasn't missing something.

I filed https://sourceware.org/bugzilla/show_bug.cgi?id=16313