From owner-freebsd-bugs@FreeBSD.ORG Wed Aug 9 19:44:04 2006 Return-Path: X-Original-To: freebsd-bugs@FreeBSD.org Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DF96A16A4DD; Wed, 9 Aug 2006 19:44:04 +0000 (UTC) (envelope-from dan@obluda.cz) Received: from smtp1.kolej.mff.cuni.cz (smtp1.kolej.mff.cuni.cz [195.113.24.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5100643D46; Wed, 9 Aug 2006 19:44:04 +0000 (GMT) (envelope-from dan@obluda.cz) X-Envelope-From: dan@obluda.cz Received: from [10.20.0.26] (openvpn.ms.mff.cuni.cz [195.113.20.87]) by smtp1.kolej.mff.cuni.cz (8.13.1/8.13.1) with ESMTP id k79JjaHg087690; Wed, 9 Aug 2006 21:45:39 +0200 (CEST) (envelope-from dan@obluda.cz) Message-ID: <44DA3AFF.1060507@obluda.cz> Date: Wed, 09 Aug 2006 21:43:59 +0200 From: Dan Lukes User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.8.0.5) Gecko/20060727 SeaMonkey/1.0.3 MIME-Version: 1.0 To: Maxim Konovalov References: <200608091914.k79JE3HM045970@freefall.freebsd.org> In-Reply-To: <200608091914.k79JE3HM045970@freefall.freebsd.org> Content-Type: text/plain; charset=ISO-8859-2; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-bugs@FreeBSD.org Subject: Re: bin/101575: [patch] Memory overflow "off-by one" in hexdump(1) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Aug 2006 19:44:05 -0000 I didn't understand why OpenBSD didn't use this way: --- current code --- size_t len; ... len = strlen(fmtp) + strlen(cs) + 1; if ((pr->fmt = calloc(1, len)) == NULL) err(1, NULL); snprintf(pr->fmt, len, "%s%s", fmtp, cs); --- better code --- asprintf(&pr->fmt, "%s%s", fmtp, cs); if (pr->fmt == NULL) err(1, NULL); ------------------- The implementatin of asprintf on FreeBSD come from OpenBSD, so it's sure the OpenBSD has this function. This situation is exactly what the asprintf is for. In advance, we need no additional variable. I think we should wrote nice effective code and allow the OpenBSD learn from FreeBSD code. At least sometime. At least when we can wrote better code ... But, I'm not sure if you are asking me for this kind of opinion. Well. Your patch close the reported hole, so it's OK. Dan -- Dan Lukes SISAL MFF UK AKA: dan@obluda.cz, dan@freebsd.cz,dan@kolej.mff.cuni.cz