lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Y5TSBUxQPhvngK7J@slm.duckdns.org>
Date:   Sat, 10 Dec 2022 08:37:57 -1000
From:   Tejun Heo <tj@...nel.org>
To:     "lilingfeng (A)" <lilingfeng3@...wei.com>
Cc:     linux-kernel@...r.kernel.org, jack@...e.cz, bingjingc@...ology.com,
        ebiggers@...gle.com, james.smart@...adcom.com, houtao1@...wei.com,
        yi.zhang@...wei.com, yangerkun@...wei.com, yukuai3@...wei.com
Subject: Re: [PATCH-next] lib: parser: optimize match_NUMER apis to use local
 array

Hello,

On Sat, Dec 10, 2022 at 10:51:11AM +0800, lilingfeng (A) wrote:
> Thank you for your advice. But I think match_number() is aimed to turn the
> string to num, so maybe it's better to return an error code rather than
> using match_stlcpy() to truncate it to give a wrong num when the string
> is too long to store.

Yeah, so, you check the the returned length and return an error code if the
returned value is too long for the buffer. That's how this family of
functions get error-checked.

> > > +{
> > > +	size_t len = s->to - s->from;
> > > +
> > > +	if (!s->from)
> > > +		return -EINVAL;
> > If we use match_strlcpy() we lose the above null check but given that other
> > match_*() functions aren't doing it, this likely shouldn't matter.
> 
> Like this:
> match_strdup
>  kmemdup_nul
>   if (!s) // null check has been done here
>    return NULL
> So I think null check may be necessary.

I mean, it's there now but other match functions don't, so it's unlikely
that the NULL check is necessary unless we're saying "parsing this type
string can encounter NULL inputs but these don't". That said, it doesn't
really matter. If you wanna keep the NULL check, do so before calling
strlcpy.

Thanks.

-- 
tejun

Powered by blists - more mailing lists