From owner-freebsd-hackers@FreeBSD.ORG Tue Aug 14 22:01:41 2007 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 28EBC16A419 for ; Tue, 14 Aug 2007 22:01:41 +0000 (UTC) (envelope-from des@des.no) Received: from tim.des.no (tim.des.no [194.63.250.121]) by mx1.freebsd.org (Postfix) with ESMTP id A498813C483 for ; Tue, 14 Aug 2007 22:01:40 +0000 (UTC) (envelope-from des@des.no) Received: from tim.des.no (localhost [127.0.0.1]) by spam.des.no (Postfix) with ESMTP id 73E6F20B2; Wed, 15 Aug 2007 00:01:34 +0200 (CEST) X-Spam-Tests: AWL X-Spam-Learn: disabled X-Spam-Score: 0.0/3.0 X-Spam-Checker-Version: SpamAssassin 3.2.1 (2007-05-02) on tim.des.no Received: from ds4.des.no (des.no [80.203.243.180]) by smtp.des.no (Postfix) with ESMTP id B2895208A; Wed, 15 Aug 2007 00:01:33 +0200 (CEST) Received: by ds4.des.no (Postfix, from userid 1001) id 9BCB084437; Wed, 15 Aug 2007 00:01:33 +0200 (CEST) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Dave Jones References: <20070814194950.GA19943@redhat.com> Date: Wed, 15 Aug 2007 00:01:33 +0200 In-Reply-To: <20070814194950.GA19943@redhat.com> (Dave Jones's message of "Tue\, 14 Aug 2007 15\:49\:50 -0400") Message-ID: <86mywt22te.fsf@ds4.des.no> User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/22.1 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: bushman@freebsd.org, freebsd-hackers@freebsd.org, rrs@freebsd.org Subject: Re: memset bugs. X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Aug 2007 22:01:41 -0000 Dave Jones writes: > A grep I crafted to pick up on some common bugs happened upon > a copy of the FreeBSD CVS tree that I happened to have handy > and found the bugs below where the 2nd & 3rd arguments to > memset calls have been swapped. > [...] > --- src/sys/netinet/sctp_output.c~ 2007-08-14 15:44:11.000000000 -0400 > +++ src/sys/netinet/sctp_output.c 2007-08-14 15:44:27.000000000 -0400 > @@ -6331,7 +6331,7 @@ out_gu: > rcv_flags |=3D SCTP_DATA_UNORDERED; > } > /* clear out the chunk before setting up */ > - memset(chk, sizeof(*chk), 0); > + memset(chk, 0, sizeof(*chk)); > chk->rec.data.rcv_flags =3D rcv_flags; > if (SCTP_BUF_IS_EXTENDED(sp->data)) { > chk->copy_by_ref =3D 1; Pointy hat to rrs@. > --- src/usr.sbin/nscd/agents/services.c~ 2007-08-14 15:44:33.000000000 -0= 400 > +++ src/usr.sbin/nscd/agents/services.c 2007-08-14 15:44:41.000000000 -04= 00 > @@ -171,7 +171,7 @@ services_lookup_func(const char *key, si > if (size > 0) { > proto =3D (char *)malloc(size + 1); > assert(proto !=3D NULL); > - memset(proto, size + 1, 0); > + memset(proto, 0, size + 1); > memcpy(proto, key + sizeof(enum nss_lookup_type) + > sizeof(int), size); > } > --- src/usr.sbin/cached/agents/services.c~ 2007-08-14 15:44:45.000000000 = -0400 > +++ src/usr.sbin/cached/agents/services.c 2007-08-14 15:44:52.000000000 -= 0400 > @@ -171,7 +171,7 @@ services_lookup_func(const char *key, si > if (size > 0) { > proto =3D (char *)malloc(size + 1); > assert(proto !=3D NULL); > - memset(proto, size + 1, 0); > + memset(proto, 0, size + 1); > memcpy(proto, key + sizeof(enum nss_lookup_type) + > sizeof(int), size); > } These two are actually the same file - cached is in the process of being renamed to nscd. Pointy hat to bushman@. > --- src/contrib/gdb/gdb/std-regs.c~ 2007-08-14 15:44:56.000000000 -0400 > +++ src/contrib/gdb/gdb/std-regs.c 2007-08-14 15:45:22.000000000 -0400 > @@ -61,7 +61,7 @@ value_of_builtin_frame_reg (struct frame > val =3D allocate_value (builtin_type_frame_reg); > VALUE_LVAL (val) =3D not_lval; > buf =3D VALUE_CONTENTS_RAW (val); > - memset (buf, TYPE_LENGTH (VALUE_TYPE (val)), 0); > + memset (buf, 0, TYPE_LENGTH (VALUE_TYPE (val))); > /* frame.base. */ > if (frame !=3D NULL) > ADDRESS_TO_POINTER (builtin_type_void_data_ptr, buf, > @@ -87,7 +87,7 @@ value_of_builtin_frame_fp_reg (struct fr > struct value *val =3D allocate_value (builtin_type_void_data_ptr); > char *buf =3D VALUE_CONTENTS_RAW (val); > if (frame =3D=3D NULL) > - memset (buf, TYPE_LENGTH (VALUE_TYPE (val)), 0); > + memset (buf, 0, TYPE_LENGTH (VALUE_TYPE (val))); > else > ADDRESS_TO_POINTER (builtin_type_void_data_ptr, buf, > get_frame_base_address (frame)); > @@ -105,7 +105,7 @@ value_of_builtin_frame_pc_reg (struct fr > struct value *val =3D allocate_value (builtin_type_void_data_ptr); > char *buf =3D VALUE_CONTENTS_RAW (val); > if (frame =3D=3D NULL) > - memset (buf, TYPE_LENGTH (VALUE_TYPE (val)), 0); > + memset (buf, 0, TYPE_LENGTH (VALUE_TYPE (val))); > else > ADDRESS_TO_POINTER (builtin_type_void_data_ptr, buf, > get_frame_pc (frame)); > --- src/contrib/gdb/gdb/remote.c~ 2007-08-14 15:45:25.000000000 -0400 > +++ src/contrib/gdb/gdb/remote.c 2007-08-14 15:45:37.000000000 -0400 > @@ -3463,7 +3463,7 @@ remote_store_registers (int regnum) > { > int i; > regs =3D alloca (rs->sizeof_g_packet); > - memset (regs, rs->sizeof_g_packet, 0); > + memset (regs, 0, rs->sizeof_g_packet); > for (i =3D 0; i < NUM_REGS + NUM_PSEUDO_REGS; i++) > { > struct packet_reg *r =3D &rs->regs[i]; These should go upstream to the gdb maintainers (bug-gdb@gnu.org). DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no