Closed progval closed 2 years ago
Sorry for replying so late, I will review it ASAP.
I think we should check the boundary of current_tag_{key,value}_ptr
at every time we bump the value of them, Otherwise, we may overflow our stack when encountering malformed messages.
Use strtok
is safer than ptr++
.
Use
strtok
is safer thanptr++
.
How? The loop needs to look for both ;
/=
and
.
Use
strtok
is safer thanptr++
.How? The loop needs to look for both
;
/=
and.
ptr = strtok(line, delim)
(first call), The delim
parameter of can be ;
=
as you want.
See also: https://www.tutorialspoint.com/c_standard_library/c_function_strtok.htm
I think we should check the boundary of
current_tag_{key,value}_ptr
at every time we bump the value of them, Otherwise, we may overflow our stack when encountering malformed messages.
Oh, good point. What if I add this at the beginning of the loop instead?
if (p >= (tags_ptr + TAGS_SIZE_LIMIT)) {
g_free(imsg->tags);
goto bad;
As current_tag_{key,value}_ptr
are incremented at most once per loop iteration, this should guarantee they don't overflow.
ptr = strtok(line, delim)
(first call), Thedelim
parameter of can be;
=
as you want.
But it can't be all of them at the same time; so I would need to call strtok twice and discard the largest result, this seems wasteful
Oh, good point. What if I add this at the beginning of the loop instead?
if (p >= (tags_ptr + TAGS_SIZE_LIMIT)) { g_free(imsg->tags); goto bad;
It is okay and would be better if you print a related error message using `ERR_FR.
As
current_tag_{key,value}_ptr
are incremented at most once per loop iteration, this should guarantee they don't overflow.
When escaping chars, ptrs are incremented twice?
But it can't be all of them at the same time; so I would need to call strtok twice and discard the largest result, this seems wasteful
Yes, so there are 2 ways:
strtok
, the flow of your code may changed: we can "check all of them" in same time*p == '\0'
every time after bump it.It is okay and would be better if you print a related error message using `ERR_FR.
Sure
When escaping chars, ptrs are incremented twice?
p
is incremented twice, but current_tag_{key,value}_ptr
only once
It is okay and would be better if you print a related error message using `ERR_FR.
Sure
When escaping chars, ptrs are incremented twice?
p
is incremented twice, butcurrent_tag_{key,value}_ptr
only once
Ahhh, yes, my fault.
Done!
Sorry for delay again, I am quite busy with both my life and work.
I will test the function of this PR weekend, then evently it can be merged.
Not doing anything with it yet, though.
If that's fine with you, I have another PR ready, to use server-time