FreeBSD Mail Archives

Date:      Sat, 21 Jan 2006 12:53:06 GMT
From:      Robert Watson <rwatson@FreeBSD.org>
To:        Perforce Change Reviews <perforce@freebsd.org>
Subject:   PERFORCE change 90067 for review
Message-ID:  <200601211253.k0LCr6KD079570@repoman.freebsd.org>

next in thread | raw e-mail | index | archive | help

http://perforce.freebsd.org/chv.cgi?CH=90067

Change 90067 by rwatson@rwatson_sesame on 2006/01/21 12:52:09

	Avoid hard-coded assumptions about C type lengths; make sure to
	include nul terminations in buffer sizing.
	
	Submitted by:	phk
	Found with:	FlexeLint

Affected files ...

.. //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#24 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#24 (text+ko) ====

@@ -89,12 +89,13 @@
 	}
 
 	textlen = strlen(text);
-	GET_TOKEN_AREA(t, dptr, 9 + textlen);
+	textlen += 1;
+
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
+	    sizeof(u_int32_t) + sizeof(u_int16_t) + textlen);
 	if (t == NULL)
 		return (NULL);
 
-	textlen += 1;
-
 	ADD_U_CHAR(dptr, AUT_ARG32);
 	ADD_U_CHAR(dptr, n);
 	ADD_U_INT32(dptr, v);
@@ -118,12 +119,13 @@
 	}
 
 	textlen = strlen(text);
-	GET_TOKEN_AREA(t, dptr, 13 + textlen);
+	textlen += 1;
+
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
+	    sizeof(u_int64_t) + sizeof(u_int16_t) + textlen);
 	if (t == NULL)
 		return (NULL);
 
-	textlen += 1;
-
 	ADD_U_CHAR(dptr, AUT_ARG64);
 	ADD_U_CHAR(dptr, n);
 	ADD_U_INT64(dptr, v);
@@ -164,7 +166,8 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 29);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2*sizeof(u_int16_t) +
+	    3*sizeof(u_int32_t) + sizeof(u_int64_t) + sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -256,7 +259,7 @@
 
 	totdata = datasize * unit_count;
 
-	GET_TOKEN_AREA(t, dptr, totdata + 4);
+	GET_TOKEN_AREA(t, dptr, totdata + 4 * sizeof(u_char));
 	if (t == NULL)
 		return (NULL);
 
@@ -281,7 +284,7 @@
 	token_t *t;
 	u_char *dptr = NULL;
 
-	GET_TOKEN_AREA(t, dptr, 9);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -460,7 +463,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 29);
+	GET_TOKEN_AREA(t, dptr, 12 * sizeof(u_int16_t) + sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -505,7 +508,7 @@
 	u_char *dptr = NULL;
 
 
-	GET_TOKEN_AREA(t, dptr, 3);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -532,7 +535,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, bytes + 3);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
 	if (t == NULL)
 		return (NULL);
 
@@ -574,11 +577,13 @@
 		return (NULL);
 	}
 	filelen = strlen(file);
-	GET_TOKEN_AREA(t, dptr, filelen + 12);
+	filelen += 1;
+
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
+	    sizeof(u_int16_t) + filelen);
 	if (t == NULL)
 		return (NULL);
 
-	filelen += 1;
 	timems = tm.tv_usec/1000;
 
 	ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
@@ -607,12 +612,12 @@
 		return (NULL);
 	}
 	textlen = strlen(text);
-	GET_TOKEN_AREA(t, dptr, textlen + 4);
+	textlen += 1;
+
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
 	if (t == NULL)
 		return (NULL);
 
-	textlen += 1;
-
 	ADD_U_CHAR(dptr, AUT_TEXT);
 	ADD_U_INT16(dptr, textlen);
 	ADD_STRING(dptr, text, textlen);
@@ -637,12 +642,12 @@
 		return (NULL);
 	}
 	textlen = strlen(text);
-	GET_TOKEN_AREA(t, dptr, textlen + 4);
+	textlen += 1;
+
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
 	if (t == NULL)
 		return (NULL);
 
-	textlen += 1;
-
 	ADD_U_CHAR(dptr, AUT_PATH);
 	ADD_U_INT16(dptr, textlen);
 	ADD_STRING(dptr, text, textlen);
@@ -675,7 +680,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 37);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -737,7 +742,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 53);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -788,7 +793,7 @@
 	token_t *t;
 	u_char *dptr = NULL;
 
-	GET_TOKEN_AREA(t, dptr, 6);
+	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -805,7 +810,7 @@
 	token_t *t;
 	u_char *dptr = NULL;
 
-	GET_TOKEN_AREA(t, dptr, 10);
+	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -833,7 +838,7 @@
 	token_t *t;
 	u_char *dptr = NULL;
 
-	GET_TOKEN_AREA(t, dptr, 5);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -901,7 +906,7 @@
 	if (so == NULL)
 		return (NULL);
 
-	GET_TOKEN_AREA(t, dptr, 107);
+	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
 	if (t == NULL)
 		return (NULL);
 
@@ -909,7 +914,7 @@
 	/* BSM token has two bytes for family */
 	ADD_U_CHAR(dptr, 0);
 	ADD_U_CHAR(dptr, so->sun_family);
-	ADD_STRING(dptr, so->sun_path, strlen(so->sun_path));
+	ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
 
 	return (t);
 }
@@ -931,7 +936,8 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 9);
+	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
+	    sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -960,7 +966,8 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 21);
+	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
+	    4 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -1014,7 +1021,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 37);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -1076,7 +1083,7 @@
 		return (NULL);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 53);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -1164,7 +1171,8 @@
 		nextarg = *(args + count);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 5 + totlen);
+	totlen += count * sizeof(char);	/* nul terminations. */
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
 	if (t == NULL)
 		return (NULL);
 
@@ -1209,7 +1217,8 @@
 		nextenv = *(env + count);
 	}
 
-	GET_TOKEN_AREA(t, dptr, 5 + totlen);
+	totlen += sizeof(char) * count;
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
 	if (t == NULL)
 		return (NULL);
 
@@ -1252,7 +1261,8 @@
 		return (NULL);
 #endif
 
-	GET_TOKEN_AREA(t, dptr, 18);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);
 
@@ -1297,7 +1307,8 @@
 	u_char *dptr = NULL;
 	u_int16_t magic = TRAILER_PAD_MAGIC;
 
-	GET_TOKEN_AREA(t, dptr, 7);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
+	    sizeof(u_int32_t));
 	if (t == NULL)
 		return (NULL);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200601211253.k0LCr6KD079570>

Header And Logo

Peripheral Links

Site Navigation

Header And Logo

Peripheral Links

Search

Site Navigation