Date: Mon, 14 Sep 1998 03:27:17 -0700 (PDT) From: sp@alkor.ru To: freebsd-gnats-submit@FreeBSD.ORG Subject: misc/7926: Probable weak code /usr/bin/cksum Message-ID: <199809141027.DAA14681@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 7926
>Category: misc
>Synopsis: Probable weak code /usr/bin/cksum
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Sep 14 03:30:00 PDT 1998
>Last-Modified:
>Originator: Sergey Potapov
>Organization:
Alkor Telecom SPb Russia
>Release: 2.2.6-RELEASE
>Environment:
FreeBSD ws.alkor.ru 2.2.6-RELEASE FreeBSD 2.2.6-RELEASE #0: Fri Apr 3 16:50:57 MSD 1998 sp@backup.alkor.ru:/usr/src/sys/compile/WORKSTAT i386
>Description:
the code (/usr/src/usr.bin/cksum/crc32.c):
while ((nr = read(fd, buf, sizeof(buf))))
for (len += nr, p = buf; nr--; ++p) {
CRC(crc, *p) ;
CRC(crc32_total, *p) ;
}
if (nr < 0)
return 1 ;
IMHO may cause infinite loop or crash of utility.
I cannot predict results if read(2) will return -1 everytime.
I did not check other modules there.
>How-To-Repeat:
>Fix:
Probably should use:
while ((nr = read(fd, buf, sizeof(buf))) > 0)
instead of:
while ((nr = read(fd, buf, sizeof(buf))))
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809141027.DAA14681>