Re: [PATCH] fix buffer overflow in udev_util_replace_whitespace()

[Andrey Borzenkov <arvidjaar@mail.ru>]

[-- Attachment #1: Type: Text/Plain, Size: 1433 bytes --]

On Saturday 05 of September 2009 22:17:52 Alan Jenkins wrote:
> On 9/5/09, Florian Zumbiehl <florz@florz.de> wrote:
> > Hi,
> >
> > [...]
> >
> >> after
> >>
> >> strnlen("a", 2-1) = 0
> >>
> > | $ cat foo.c
> > |
> > | #include <string.h>
> > | #include <stdio.h>
> > |
> > | int main(){
> > | 	printf("%u\n",strnlen("a",2-1));
> > | 	return 0;
> > | }
> > |
> > | $ gcc -o foo foo.c
> > | $ ./foo
> > | 1
> > | $
> >
> > Florian
> 
> Indeed, excuse my brainfart.  Looking at the rest of the function I
> agree it needs fixing,  Unless Andrey can correct us.
> 

This change breaks udev_util_replace_whitespace().

#include <stdio.h>
#include <stddef.h>

main()
{
        int len = 3, i, j;
        char *str = "a b";
        char to[10];

        len = strnlen(str, len - 1);
        while (len && isspace(str[len-1]))
                len--;

        j = i = 0;
        while (i < len) {
                /* substitute multiple whitespace with a single '_' */
                if (isspace(str[i])) {
                        while (isspace(str[i]))
                                i++;
                        to[j++] = '_';
                        }
                to[j++] = str[i++];
        }
        to[j] = '\0';

        printf("'%s'\n", to);
}

{pts/1}% gcc -O0 foo.c
{pts/1}% ./a.out
'a'

instead of expected a_b

What is exact problem with original code? 

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]