From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/136 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: cluts review Date: Wed, 13 Jul 2011 10:03:04 -0400 Message-ID: <20110713140304.GE16618@brightrain.aerifal.cx> References: <20110713110723.GA22153@openwall.com> <4E1D8964.3020502@gmail.com> <20110713122128.GA22658@openwall.com> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1310566355 7866 80.91.229.12 (13 Jul 2011 14:12:35 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Wed, 13 Jul 2011 14:12:35 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-220-gllmg-musl=m.gmane.org@lists.openwall.com Wed Jul 13 16:12:32 2011 Return-path: Envelope-to: gllmg-musl@lo.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by lo.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Qh0Ax-0003ii-2A for gllmg-musl@lo.gmane.org; Wed, 13 Jul 2011 16:12:31 +0200 Original-Received: (qmail 17740 invoked by uid 550); 13 Jul 2011 14:12:30 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 17731 invoked from network); 13 Jul 2011 14:12:30 -0000 Content-Disposition: inline In-Reply-To: <20110713122128.GA22658@openwall.com> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:136 Archived-At: On Wed, Jul 13, 2011 at 04:21:28PM +0400, Solar Designer wrote: > > Instead of > > for PATH_MAX, will limits.h do (that's what i usually include)? > > No, it doesn't get PATH_MAX defined for me. Even with _POSIX_C_SOURCE=200809L? Did glibc really go and break that too? :( The standard doesn't require it to be defined, but this is just like their issue of removing PAGE_SIZE. All it does is create more work and bloat for the application which has to go retrieve the value via sysconf/pathconf. And if these still return "unlimited", then many interfaces have *inherent* security bugs that cannot be fixed due to writing out a string that's assumed to be able to accommodate at least PATH_MAX bytes... > What you could actually want to do is get rid of the dependency on > PATH_MAX and FILENAME_MAX. The system does not guarantee that actual > pathnames fit in PATH_MAX anyway. So you may want to replace those > strcat()'s with dynamic memory allocation or add a check for potential > buffer overflow there (then report the error and skip the test). Indeed, I would use snprintf for this and just error out if the string gets truncated, but you could also perform dynamic allocation. Rich