djveremix / redis

Automatically exported from code.google.com/p/redis
0 stars 0 forks source link

return value from mem*() functions not checked #268

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago

In the file sds.c, function sdscatlen(), the return value from the memcpy() is 
not checked. Sometimes memcpy() actually shifts the dest address ....

In my case this resulted in a sdscatlen() not concatenating the string.
calling sdscattlen() with strings like "jack", ",", "jill" will trigger this 
... i think the 2 byte memcpy() can cause the next memcpy() to return a 
different dest address.

Not checking memcpy(), memset(), memmove(), etc... return values is dangerous. 
It results in bugs that are almost impossible to track down.

Original issue reported on code.google.com by jaksprats on 25 Jun 2010 at 11:29

GoogleCodeExporter commented 9 years ago
Really?  I've just been checking all the docs I could find, and they all seem 
to agree that memcpy() returns the value passed as its first parameter.  eg: 
http://www.opengroup.org/onlinepubs/009695399/functions/memcpy.html
I've never heard of memcpy() returning a different destination address (and I 
can't see how it could reasonably do so without doing memory allocation, which 
would seem like a crazy thing for a memcpy to be doing).

Do you have some example code which exhibits the bug?  I suspect the problem 
isn't with memcpy, but somewhere else instead.

Original comment by boulton.rj@gmail.com on 25 Jun 2010 at 1:10

GoogleCodeExporter commented 9 years ago
In MY code, so not redis code, I found a spot where i did something dumb: like 
incorrectly cast a pointer and modify something that wasnt what it should be.

Anyways, this could have corrupted the stack or the heap and cause memcpy() 
returning a different value.

I remember this vaguely happening on a different project and it pointed to a 
larger problem, so I have always done an assert() to make sure the returned 
value is the same as the dest pointer

close this issue, if I can reproduce it, I will reopen it

Original comment by jaksprats on 26 Jun 2010 at 7:16

GoogleCodeExporter commented 9 years ago

Original comment by pcnoordh...@gmail.com on 26 Jun 2010 at 9:30