From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35959) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aHpsM-0003ME-15 for qemu-devel@nongnu.org; Sat, 09 Jan 2016 04:31:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aHpsI-0004Ui-Qv for qemu-devel@nongnu.org; Sat, 09 Jan 2016 04:31:57 -0500 Received: from proxmox.maurer-it.com ([94.136.31.133]:49992) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aHpsI-0004Po-IF for qemu-devel@nongnu.org; Sat, 09 Jan 2016 04:31:54 -0500 Date: Sat, 9 Jan 2016 10:31:40 +0100 (CET) From: Wolfgang Bumiller Message-ID: <1907860725.4.388b58e8-5b06-4844-be0c-df2778eb46fb.open-xchange@webmail.proxmox.com> In-Reply-To: References: <20160108091949.GA14724@olga> <20160108130251.GA17847@olga> <20160108143831.GA7632@olga> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] hmp: avoid redundant null termination of buffer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P Cc: qemu-devel@nongnu.org, Ling Liu > On January 8, 2016 at 6:32 PM P J P wrote: > > > +-- On Fri, 8 Jan 2016, Wolfgang Bumiller wrote --+ > | On Fri, Jan 08, 2016 at 07:29:31PM +0530, P J P wrote: > | > + if (!strncmp(keyname_buf, "<-", 2)) > | > and remove the 'keyname_len' altogether. > | > | This wouldn't catch '<' without '-'. (`sendkey <`) > | Also, strncmp with a length of 1 (in the original) seems weird. > > Ah, true. > > | keyname_len is not useless and perhaps it would be best to just do an > | early error check there as I do below. > | > | Alternatively the if() can simply happen after pstrcpy() as a cut-off > | error should be good enough anyway. > | > | @@ -1749,6 +1749,9 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict) > | while (1) { > | separator = strchr(keys, '-'); > | keyname_len = separator ? separator - keys : strlen(keys); > | + if (keyname_len >= sizeof(keyname_buf)) > | + goto err_out; > | + > | pstrcpy(keyname_buf, sizeof(keyname_buf), keys); > > Yes, this looks good. With that, maybe 'keyname_len' could be sent to > pstrcpy() above, instead of sizeof(keyname_buf)? If so, then the subsequent if > > could say: if (!strcmp(keyname_buf, "<")). keyname_len+1 (size instead of length) to include the \0, then yes I think strcmp can be used this way. The +1 should be fine there (since >= covers it).