Re: macro conflict

[daw@mozart.cs.berkeley.edu (David Wagner)]

Richard B. Johnson wrote:
>Looking through the code, min() is most always used to find some value
>that will not overflow some buffer, i.e.,
>
>    len = min(user_request_len, sizeof(buffer));
>
>The problem is that sizeof() returns an unsigned int (size_t), and the
>user request length may be an integer. Everything works fine until
>you get to lengths with the high bit set. Then, you are in trouble.
>
>In this case, you could have a 'min()' that does:
>
>#define min(a,b) (unsigned long)(a) < (unsigned long)(b) ? (a) : (b)
>
>... where the comparison (only) is made unsigned, and you keep the
>original values. This should work, perhaps in all the current uses.

Just a small warning:  If anyone writes something like
    int len = min(user_request_len, sizeof(buffer));
    if (user_request_len > len)
        goto fail;
    memcpy(dst, user_src, len);
they can get into trouble even with your min() macro.
Ok, maybe this is crazy code that noone in their right
mind would ever write.

This is not intended as a criticism -- your approach may be
sufficient for existing code -- but it is something to watch
out for.