apache / celix

Apache Celix is a framework for C and C++14 to develop dynamic modular software applications using component and in-process service-oriented programming.
https://celix.apache.org/
Apache License 2.0
167 stars 88 forks source link

Questions about manifest.c #527

Closed PengZheng closed 1 year ago

PengZheng commented 1 year ago
  1. manifest->mainAttributes is dropped in manifest_clone.
  2. manifest->attributes seems empty most of the time: the while loop after manifest_readAttributes(manifest, manifest->mainAttributes, file) seems NEVER entered.
        manifest_readAttributes(manifest, manifest->mainAttributes, file);
        // fgets almost always returns NULL
        while (status==CELIX_SUCCESS && fgets(lbuf, sizeof(lbuf), file) != NULL) {
                }
  3. The line continuation logic may lead to stack overflow for malicious manifest.

I don't understand why is manifest->attributes there?