From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13621 Path: news.gmane.org!.POSTED!not-for-mail From: Markus Wichmann Newsgroups: gmane.linux.lib.musl.general Subject: Re: function: fgetspent_r Date: Fri, 18 Jan 2019 21:37:25 +0100 Message-ID: <20190118203725.GI29911@voyager> References: <4ac5ac1b-217f-442f-fc35-bfbf015287bb@adelielinux.org> <20190116205046.GK23599@brightrain.aerifal.cx> <20190116234410.GL23599@brightrain.aerifal.cx> <20190117053147.GH29911@voyager> <20190117153830.GN23599@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1547843770 4979 195.159.176.226 (18 Jan 2019 20:36:10 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 18 Jan 2019 20:36:10 +0000 (UTC) User-Agent: Mutt/1.10.1 (2018-07-13) To: musl@lists.openwall.com Original-X-From: musl-return-13637-gllmg-musl=m.gmane.org@lists.openwall.com Fri Jan 18 21:36:06 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1gkas1-0001Bl-Te for gllmg-musl@m.gmane.org; Fri, 18 Jan 2019 21:36:05 +0100 Original-Received: (qmail 7838 invoked by uid 550); 18 Jan 2019 20:38:15 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 7818 invoked from network); 18 Jan 2019 20:38:15 -0000 Content-Disposition: inline In-Reply-To: <20190117153830.GN23599@brightrain.aerifal.cx> X-Provags-ID: V03:K1:xkE4jAGMIUz3zv+gIxJ0nKHp+kdrubouPaU6qCmGIJhWUZyLNky bae7C8wibUVOEZxya87/b/sHXYpSNlBCbqrqFMsxHBMQSO3VpQ9579yUBSO32eRiZV1Y4/y ZFKIiXOs/BygFjfwhuq8l36Ap44H09WNyMNNxH4Z7ZFrfgiySLpBjL1/Wd8jaEwh4M8JwuF Dgqy8HQ5kbSZC1RhoF+0Q== X-UI-Out-Filterresults: notjunk:1;V03:K0:Rz1ZhBtw82o=:RiwqwzXhVNRMlWgeoGccfs GQ6sGdojObxDv/ksBlpqg+Uq/lkhTZapCTnW4R6eLHfz8ekPMmU9vwZbL8PqdUsf3Rkr56DiX EvP5YbK7+YA5t50rnzVsdi7LQsU8jj1X8XVnZVCRUuCOpkFV/otmiFwNGx/2Budy0rn6jgzqJ YoeMHLBQsIkFFI76aipZveTFzVpcD/L8qLbcxXMo8afyz+XqertEpBHvdbnsiRhGc2y/Yum8O l5xDK1B2KGFCaL9q2KDenOxWh5zB/6LVvNcpjwhKkooDqUF7LAk9pAAkO2S/sJhS2IMOyOzJs KFFFnUJ9BrVdOQ0OIVVOG5j6A1OVjSSu0twaKEUwXE/f1/xaIsdFZYvHf6HTqVT2Tjyr8mSsp f/+SXT6nbyQYzFCYbHrzW0c61veUJaXIUfrZf8NFZtEKLxVJeBwM1SbAg86l6MGr7i0tyFKla 17pr+vJxUWkpgMwM5+chWwzsUeSraclQR2nsbLhILdb0AzClPGL6+bK3M3tRQUGdp1gcDtKZl E2cC8wypOnDvMTx+KS8ZH5MA97v3Tm0BjN/5hEK9QSFA0KLMB+CyIiXUG2d8AJJK1frOr2Bvd rCQ4BBaKZL0NuurlKmJdt3Z4uR4eBjyM5ZjrCqhXMkEjoADozLi3noyq5NYTtQdCt7FQ43NZg qurkarnjU0JgnyGcU9qIjRJyAKsj5RxNXOSwExsdZgf3pB86oynfjGyfvKfF0L+1ty7y76sjY zDpMmPLj6XyZxy2DM2KUvpUy8ik3/szqlMEbD+Pu84k0sCPbfCsARdxGzRKWim3+9+OVG0Y1 Xref: news.gmane.org gmane.linux.lib.musl.general:13621 Archived-At: Hi all, so I had a look at the glibc implementation (from v2.24, which I had lying around), and here are my findings: They don't return on format error. Instead, they loop. On buffer too short, they will leave the stream where it is and return ERANGE. And on end of file, they return ENOENT, which I find bizarre. Looking at my own implementation, I am not certain if cleaning up a faulty state is desirable, since non-recoverable situations exist. fgetspent_r() has the invariant that the file position is pointing to the start of a line. So, first thought was to use ftell() beforehand and fseek() on error, to revert to the start of a line. However, that really only helps with the "buffer too short" case. An illegal line won't become more acceptable, no matter how many times we reread it. Rich correctly pointed out that a file might not be seekable. So if reversing isn't an option, we can only go forward. So I added an fgets() loop in case the fseek() fails. But fgets() can fail, too. Maybe even spuriously (what happens if the file is actually an fdopen()ed nonblocking TCP socket or something?), so that the problem fixes itself. Then the invariant is still violated and we have no indication of anything being wrong. So, since it is impossible to guarantee the invariant, and the user certainly has no way to check, I think telling the user to close the file on any error is probably the best choice here (i.e. the choice that saves me the most work). Looping on format error sounds attractive as well, but I think we'd want that behavior to be consistent across the entire src/passwd directory, right? It would allow slightly broken files to be present in the system without bricking it. On the other hand, permissivity is usually only a good thing outside of security contexts. Thoughts? Ciao, Markus