Re: [9fans] lpdaemon

[Don Bailey <don.bailey@gmail.com>]

The first opportunity to write a nil byte should always be taken. Using sizeof only means that in corner cases memory disclosure may occur between where the nil should be and the end of the array. While this isn't a security critical app, it is still good coding practice.

x = strlen(info.host) < sizeof info.host ? strlen() : sizeof ;
info.host[x] = 0;

D

On Jun 5, 2013, at 5:38 AM, yaroslav <yarikos@gmail.com> wrote:

> in /sys/src/cmd/lp/lpdaemon.c:297,310
> 
> These
>            info.host[strlen(info.host)] = '\0';
>            …
>            info.user[strlen(info.user)] = '\0';
> 
> look nonsence as zeros are placed exactly where they already are.
> Should read as in following instead:
> 
>            info.host[NAMELEN] = '\0';
>            …
>            info.user[NAMELEN] = '\0';
> 
> shoudn't it?
> 
>