From mboxrd@z Thu Jan 1 00:00:00 1970 From: Olivier MATZ Subject: Re: [PATCH v6 04/19] eal: fix wrong strnlen() return value in 32bit icc Date: Fri, 13 Feb 2015 15:05:44 +0100 Message-ID: <54DE04B8.6080708@6wind.com> References: <1423728996-3004-1-git-send-email-cunming.liang@intel.com> <1423791501-1555-1-git-send-email-cunming.liang@intel.com> <1423791501-1555-5-git-send-email-cunming.liang@intel.com> <20150213134933.GA13495@neilslaptop.think-freely.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: dev-VfR2kkLFssw@public.gmane.org To: Neil Horman , Cunming Liang Return-path: In-Reply-To: <20150213134933.GA13495-0o1r3XBGOEbbgkc5XkKeNuvMHUBZFtU3YPYVAmT7z5s@public.gmane.org> List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces-VfR2kkLFssw@public.gmane.org Sender: "dev" Hi Neil, On 02/13/2015 02:49 PM, Neil Horman wrote: > On Fri, Feb 13, 2015 at 09:38:06AM +0800, Cunming Liang wrote: >> The problem is that strnlen() here may return invalid value with 32bit= icc. >> (actually it returns it=E2=80=99s second parameter,e.g: sysconf(_SC_AR= G_MAX)). >> It starts to manifest hwen max_len parameter is > 2M and using icc =E2= =80=93m32 =E2=80=93O2 (or above). >> >> Suggested-by: Konstantin Ananyev >> Signed-off-by: Cunming Liang >> --- >> v5 changes: >> using strlen instead of strnlen. >> >> lib/librte_eal/common/eal_common_options.c | 6 +++--- >> 1 file changed, 3 insertions(+), 3 deletions(-) >> >> diff --git a/lib/librte_eal/common/eal_common_options.c b/lib/librte_e= al/common/eal_common_options.c >> index 178e303..9cf2faa 100644 >> --- a/lib/librte_eal/common/eal_common_options.c >> +++ b/lib/librte_eal/common/eal_common_options.c >> @@ -167,7 +167,7 @@ eal_parse_coremask(const char *coremask) >> if (coremask[0] =3D=3D '0' && ((coremask[1] =3D=3D 'x') >> || (coremask[1] =3D=3D 'X'))) >> coremask +=3D 2; >> - i =3D strnlen(coremask, PATH_MAX); >> + i =3D strlen(coremask); > This is crash prone. If coremask is passed in without a trailing null = pointer, > strlen will return a huge value that can overrun the array. We discussed that in a previous thread: http://dpdk.org/ml/archives/dev/2015-February/012552.html coremask is always a valid nul-terminated string as it comes from argv[] table. It is not a memory fragment that is controlled by a user, so I don't think using strnlen() instead of strlen() would solve any issue. Regards, Olivier