From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ferruh.yigit@intel.com>
Received: from mga03.intel.com (mga03.intel.com [134.134.136.65])
by dpdk.org (Postfix) with ESMTP id F0FEF5F21;
Wed, 27 Mar 2019 12:37:53 +0100 (CET)
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from orsmga008.jf.intel.com ([10.7.209.65])
by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;
27 Mar 2019 04:37:53 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.60,276,1549958400"; d="scan'208";a="129074255"
Received: from fyigit-mobl.ger.corp.intel.com (HELO [10.237.221.46])
([10.237.221.46])
by orsmga008.jf.intel.com with ESMTP; 27 Mar 2019 04:37:50 -0700
To: "Chaitanya Babu, TalluriX" <tallurix.chaitanya.babu@intel.com>,
"Richardson, Bruce" <bruce.richardson@intel.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>, "Pattan, Reshma" <reshma.pattan@intel.com>,
"Parthasarathy, JananeeX M" <jananeex.m.parthasarathy@intel.com>,
"Dumitrescu, Cristian" <cristian.dumitrescu@intel.com>,
"stable@dpdk.org" <stable@dpdk.org>
References: <1550136631-32415-1-git-send-email-tallurix.chaitanya.babu@intel.com>
<1552049150-5046-1-git-send-email-tallurix.chaitanya.babu@intel.com>
<20190308140205.GA689548@bricha3-MOBL.ger.corp.intel.com>
<2c2ea69f-38f3-677d-b4a6-996f1668dd44@intel.com>
<761FB0F2AB727F4FA9CE98D18810B0151B1F18AA@BGSMSX103.gar.corp.intel.com>
From: Ferruh Yigit <ferruh.yigit@intel.com>
Openpgp: preference=signencrypt
Autocrypt: addr=ferruh.yigit@intel.com; prefer-encrypt=mutual; keydata=
mQINBFXZCFABEADCujshBOAaqPZpwShdkzkyGpJ15lmxiSr3jVMqOtQS/sB3FYLT0/d3+bvy
qbL9YnlbPyRvZfnP3pXiKwkRoR1RJwEo2BOf6hxdzTmLRtGtwWzI9MwrUPj6n/ldiD58VAGQ
+iR1I/z9UBUN/ZMksElA2D7Jgg7vZ78iKwNnd+vLBD6I61kVrZ45Vjo3r+pPOByUBXOUlxp9
GWEKKIrJ4eogqkVNSixN16VYK7xR+5OUkBYUO+sE6etSxCr7BahMPKxH+XPlZZjKrxciaWQb
+dElz3Ab4Opl+ZT/bK2huX+W+NJBEBVzjTkhjSTjcyRdxvS1gwWRuXqAml/sh+KQjPV1PPHF
YK5LcqLkle+OKTCa82OvUb7cr+ALxATIZXQkgmn+zFT8UzSS3aiBBohg3BtbTIWy51jNlYdy
ezUZ4UxKSsFuUTPt+JjHQBvF7WKbmNGS3fCid5Iag4tWOfZoqiCNzxApkVugltxoc6rG2TyX
CmI2rP0mQ0GOsGXA3+3c1MCdQFzdIn/5tLBZyKy4F54UFo35eOX8/g7OaE+xrgY/4bZjpxC1
1pd66AAtKb3aNXpHvIfkVV6NYloo52H+FUE5ZDPNCGD0/btFGPWmWRmkPybzColTy7fmPaGz
cBcEEqHK4T0aY4UJmE7Ylvg255Kz7s6wGZe6IR3N0cKNv++O7QARAQABtCVGZXJydWggWWln
aXQgPGZlcnJ1aC55aWdpdEBpbnRlbC5jb20+iQJVBBMBAgA/AhsDBgsJCAcDAgYVCAIJCgsE
FgIDAQIeAQIXgBYhBNI2U4dCLsKE45mBx/kz60PfE2EfBQJbughWBQkHwjOGAAoJEPkz60Pf
E2Eft84QAIbKWqhgqRfoiw/BbXbA1+qm2o4UgkCRQ0yJgt9QsnbpOmPKydHH0ixCliNz1J8e
mRXCkMini1bTpnzp7spOjQGLeAFkNFz6BMq8YF2mVWbGEDE9WgnAxZdi0eLY7ZQnHbE6AxKL
SXmpe9INb6z3ztseFt7mqje/W/6DWYIMnH3Yz9KzxujFWDcq8UCAvPkxVQXLTMpauhFgYeEx
Nub5HbvhxTfUkapLwRQsSd/HbywzqZ3s/bbYMjj5JO3tgMiM9g9HOjv1G2f1dQjHi5YQiTZl
1eIIqQ3pTic6ROaiZqNmQFXPsoOOFfXF8nN2zg8kl/sSdoXWHhama5hbwwtl1vdaygQYlmdK
H2ueiFh/UvT3WG3waNv2eZiEbHV8Rk52Xyn2w1G90lV0fYC6Ket1Xjoch7kjwbx793Kz/RfQ
rmBY8/S4DTGn3oq3dMdQY+b6+7VMUeLMMh2CXYO9ErkOq+qNTD1IY+cBAkXnaDbQfz0zbste
ZGWH74FAZ9nCpDOqbRTrBL42aMGhfOWEyeA1x7+hl6JZfabBWAuf4nnCXuorKHzBXTrf7u7p
fXsKQClWRW77PF1VmzrtKNVSytQAmlCWApQIw20AarFipXmVdIjHmJPU611WoyxZPb4JTOxx
5cv9B+nr/RIB+v5dcStyHCCwO1be7nBDdCgd4F6kTQPLuQINBFfWTL4BEACnNA29e8TarUsB
L5n6eLZHXcFvVwNLVlirWOClHXf44o2KnN3ww+eBEmKVfEFo9MSuGDNHS8Zw1NiGMYxLIUgd
U6gGrVVs/VrQWL82pbMk6jCj98N+BXIri+6K1z+AImz7ax7iF1kDgRAnFWU0znWWBgM2mM8Y
gDjcxfXk4sCKnvf6Gjo08Ey5zmqx7dekAKU2EEp8Q1EJY3jbymLdZWRP4AFFMTS1rGMk0/tt
v71NBg1GobCcbNfn9chK/jhqxYhAJqq86RdJQkt3/9x1U1Oq0vXCt4JVVHmkxePtUiuWTTt+
aYlUAsKYZsWvncExvw77x2ArYDmaK0yfjh37wp0lY7DOJHFxoyT8tyWZlLci/VMRG2Ja33xj
0CN4C1yBg+QDeV3QFxQo42iA/ykdXPUR3ezmsND3XKvVLTC4DNb3V/EZQ7jBj64+bEK0VW4G
B31VP00ApNQvSoczsIOAKdk97RNbpmPw6q10ILIB+9T1xbnFYzshzGF17oC0/GENIHATx8vZ
masOZoDiOZQpeneLgnFE9JfzhLTxv6wNZcc/HLXRQVTkDsQr8ERtkAoHCf1E5+b5Yr7pfnE4
YuhET746o25S53ELUYPIs49qoJsEJL34/oexMfPGyPIlrbufiNyty5jc/1MRwUlhJlJ5IOHy
ZUa+6CLR7GdImusFkPJUJwARAQABiQI8BBgBAgAmAhsMFiEE0jZTh0IuwoTjmYHH+TPrQ98T
YR8FAlu6CHAFCQXE7zIACgkQ+TPrQ98TYR9nXxAAqNBgkYNyGuWUuy0GwDQCbu3iiMyH1+D7
llafPcK4NYy1Z4AYuVwC9nmLaoj+ozdqS3ncRo57ncRsKEJC46nDJJZYZ5LSJVn63Y3NBF86
lxQAgjj2oyZEwaLKtKbAFsXL43jv1pUGgSvWwYtDwHITXXFQto9rZEuUDRFSx4sg9OR+Q6/6
LY+nQQ3OdHlBkflzYMPcWgDcvcTAO6yasLEUf7UcYoSWTyMYjLB4QuNlXzTswzGVMssJF/vo
V8lD1eqqaSUWG3STF6GVLQOr1NLvN5+kUBiEStHFxBpgSCvYY9sNV8FS6N24CAWMBl+10W+D
2h1yiiP5dOdPcBDYKsgqDD91/sP0WdyMJkwdQJtD49f9f+lYloxHnSAxMleOpyscg1pldw+i
mPaUY1bmIknLhhkqfMmjywQOXpac5LRMibAAYkcB8v7y3kwELnt8mhqqZy6LUsqcWygNbH/W
K3GGt5tRpeIXeJ25x8gg5EBQ0Jnvp/IbBYQfPLtXH0Myq2QuAhk/1q2yEIbVjS+7iowEZNyE
56K63WBJxsJPB2mvmLgn98GqB4G6GufP1ndS0XDti/2K0o8rep9xoY/JDGi0n0L0tk9BHyoP
Y7kaEpu7UyY3nVdRLe5H1/MnFG8hdJ97WqnPS0buYZlrbTV0nRFL/NI2VABl18vEEXvNQiO+ vM8=
Message-ID: <d5f01da4-b9a7-67f1-860a-dcd7c354da40@intel.com>
Date: Wed, 27 Mar 2019 11:37:50 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <761FB0F2AB727F4FA9CE98D18810B0151B1F18AA@BGSMSX103.gar.corp.intel.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [dpdk-dev] [PATCH v2] lib/cfgfile: replace strcat with strlcat
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Mar 2019 11:37:54 -0000
On 3/26/2019 10:04 AM, Chaitanya Babu, TalluriX wrote:
> Hi
>
>> -----Original Message-----
>> From: Yigit, Ferruh
>> Sent: Friday, March 8, 2019 11:01 PM
>> To: Richardson, Bruce <bruce.richardson@intel.com>; Chaitanya Babu, TalluriX
>> <tallurix.chaitanya.babu@intel.com>
>> Cc: dev@dpdk.org; Pattan, Reshma <reshma.pattan@intel.com>;
>> Parthasarathy, JananeeX M <jananeex.m.parthasarathy@intel.com>;
>> Dumitrescu, Cristian <cristian.dumitrescu@intel.com>; stable@dpdk.org
>> Subject: Re: [PATCH v2] lib/cfgfile: replace strcat with strlcat
>>
>> On 3/8/2019 2:02 PM, Bruce Richardson wrote:
>>> On Fri, Mar 08, 2019 at 12:45:50PM +0000, Chaitanya Babu Talluri wrote:
>>>> Replace strcat with strlcat to avoid buffer overflow.
>>>>
>>>> Fixes: a6a47ac9c2 ("cfgfile: rework load function")
>>>> Cc: stable@dpdk.org
>>>>
>>>> Signed-off-by: Chaitanya Babu Talluri
>>>> <tallurix.chaitanya.babu@intel.com>
>>>> ---
>>>> v2: Instead of strcat, used strlcat.
>>>> ---
>>>> lib/librte_cfgfile/rte_cfgfile.c | 4 +++-
>>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/lib/librte_cfgfile/rte_cfgfile.c
>>>> b/lib/librte_cfgfile/rte_cfgfile.c
>>>> index 7d8c941ea..3296bb6f8 100644
>>>> --- a/lib/librte_cfgfile/rte_cfgfile.c
>>>> +++ b/lib/librte_cfgfile/rte_cfgfile.c
>>>> @@ -8,6 +8,7 @@
>>>> #include <ctype.h>
>>>> #include <errno.h>
>>>> #include <rte_common.h>
>>>> +#include <rte_string_fns.h>
>>>>
>>>> #include "rte_cfgfile.h"
>>>>
>>>> @@ -224,10 +225,11 @@ rte_cfgfile_load_with_params(const char
>> *filename, int flags,
>>>> _strip(split[1], strlen(split[1]));
>>>> char *end = memchr(split[1], '\\', strlen(split[1]));
>>>>
>>>> + size_t split_len = strlen(split[1]) + 1;
>>>> while (end != NULL) {
>>>> if (*(end+1) == params->comment_character)
>> {
>>>> *end = '\0';
>>>> - strcat(split[1], end+1);
>>>> + strlcat(split[1], end+1, split_len);
>>>
>>> I don't think this will do what you want. Remember that strlcat takes
>>> the total length of the buffer, which means that if split_len is set
>>> to the current length (as you do before the while statement), then
>>> passing that as the length parameter will cause strlcat to do nothing,
>>> since it sees the buffer as already full.
>>
>> The logic doesn't lengthen the 'split[1]' content, indeed it reduces the initial
>> size although it uses string concatenation, that is why it should be OK to use
>> 'split_len' here.
>>
>> What code does is, it finds specific char in 'split' buffer and removes it by
>> shifting remaining chars one byte to the left. So it shouldn't pass the initial size
>> of the buffer.
>>
>> There is a overlapping strings concern, which 'strcat' & 'strlcat' don't support,
>> but I guess it is OK here since we are sure that strings are separated by a
>> NULL, so where a char read and written should be different although overall
>> dst and src buffers overlap.
>
> Yes, although the same string is manipulated the split string (*end = '\0') is separated with NULL.
> Strlcat works fine here and expected concatenation is happening.
> If there are no further comments request for ACK please.
Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>
From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from dpdk.org (dpdk.org [92.243.14.124])
by dpdk.space (Postfix) with ESMTP id 908D4A05D3
for <public@inbox.dpdk.org>; Wed, 27 Mar 2019 12:37:56 +0100 (CET)
Received: from [92.243.14.124] (localhost [127.0.0.1])
by dpdk.org (Postfix) with ESMTP id 5345B1B112;
Wed, 27 Mar 2019 12:37:56 +0100 (CET)
Received: from mga03.intel.com (mga03.intel.com [134.134.136.65])
by dpdk.org (Postfix) with ESMTP id F0FEF5F21;
Wed, 27 Mar 2019 12:37:53 +0100 (CET)
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from orsmga008.jf.intel.com ([10.7.209.65])
by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;
27 Mar 2019 04:37:53 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.60,276,1549958400"; d="scan'208";a="129074255"
Received: from fyigit-mobl.ger.corp.intel.com (HELO [10.237.221.46])
([10.237.221.46])
by orsmga008.jf.intel.com with ESMTP; 27 Mar 2019 04:37:50 -0700
To: "Chaitanya Babu, TalluriX" <tallurix.chaitanya.babu@intel.com>,
"Richardson, Bruce" <bruce.richardson@intel.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>, "Pattan, Reshma" <reshma.pattan@intel.com>,
"Parthasarathy, JananeeX M" <jananeex.m.parthasarathy@intel.com>,
"Dumitrescu, Cristian" <cristian.dumitrescu@intel.com>,
"stable@dpdk.org" <stable@dpdk.org>
References: <1550136631-32415-1-git-send-email-tallurix.chaitanya.babu@intel.com>
<1552049150-5046-1-git-send-email-tallurix.chaitanya.babu@intel.com>
<20190308140205.GA689548@bricha3-MOBL.ger.corp.intel.com>
<2c2ea69f-38f3-677d-b4a6-996f1668dd44@intel.com>
<761FB0F2AB727F4FA9CE98D18810B0151B1F18AA@BGSMSX103.gar.corp.intel.com>
From: Ferruh Yigit <ferruh.yigit@intel.com>
Openpgp: preference=signencrypt
Autocrypt: addr=ferruh.yigit@intel.com; prefer-encrypt=mutual; keydata=
mQINBFXZCFABEADCujshBOAaqPZpwShdkzkyGpJ15lmxiSr3jVMqOtQS/sB3FYLT0/d3+bvy
qbL9YnlbPyRvZfnP3pXiKwkRoR1RJwEo2BOf6hxdzTmLRtGtwWzI9MwrUPj6n/ldiD58VAGQ
+iR1I/z9UBUN/ZMksElA2D7Jgg7vZ78iKwNnd+vLBD6I61kVrZ45Vjo3r+pPOByUBXOUlxp9
GWEKKIrJ4eogqkVNSixN16VYK7xR+5OUkBYUO+sE6etSxCr7BahMPKxH+XPlZZjKrxciaWQb
+dElz3Ab4Opl+ZT/bK2huX+W+NJBEBVzjTkhjSTjcyRdxvS1gwWRuXqAml/sh+KQjPV1PPHF
YK5LcqLkle+OKTCa82OvUb7cr+ALxATIZXQkgmn+zFT8UzSS3aiBBohg3BtbTIWy51jNlYdy
ezUZ4UxKSsFuUTPt+JjHQBvF7WKbmNGS3fCid5Iag4tWOfZoqiCNzxApkVugltxoc6rG2TyX
CmI2rP0mQ0GOsGXA3+3c1MCdQFzdIn/5tLBZyKy4F54UFo35eOX8/g7OaE+xrgY/4bZjpxC1
1pd66AAtKb3aNXpHvIfkVV6NYloo52H+FUE5ZDPNCGD0/btFGPWmWRmkPybzColTy7fmPaGz
cBcEEqHK4T0aY4UJmE7Ylvg255Kz7s6wGZe6IR3N0cKNv++O7QARAQABtCVGZXJydWggWWln
aXQgPGZlcnJ1aC55aWdpdEBpbnRlbC5jb20+iQJVBBMBAgA/AhsDBgsJCAcDAgYVCAIJCgsE
FgIDAQIeAQIXgBYhBNI2U4dCLsKE45mBx/kz60PfE2EfBQJbughWBQkHwjOGAAoJEPkz60Pf
E2Eft84QAIbKWqhgqRfoiw/BbXbA1+qm2o4UgkCRQ0yJgt9QsnbpOmPKydHH0ixCliNz1J8e
mRXCkMini1bTpnzp7spOjQGLeAFkNFz6BMq8YF2mVWbGEDE9WgnAxZdi0eLY7ZQnHbE6AxKL
SXmpe9INb6z3ztseFt7mqje/W/6DWYIMnH3Yz9KzxujFWDcq8UCAvPkxVQXLTMpauhFgYeEx
Nub5HbvhxTfUkapLwRQsSd/HbywzqZ3s/bbYMjj5JO3tgMiM9g9HOjv1G2f1dQjHi5YQiTZl
1eIIqQ3pTic6ROaiZqNmQFXPsoOOFfXF8nN2zg8kl/sSdoXWHhama5hbwwtl1vdaygQYlmdK
H2ueiFh/UvT3WG3waNv2eZiEbHV8Rk52Xyn2w1G90lV0fYC6Ket1Xjoch7kjwbx793Kz/RfQ
rmBY8/S4DTGn3oq3dMdQY+b6+7VMUeLMMh2CXYO9ErkOq+qNTD1IY+cBAkXnaDbQfz0zbste
ZGWH74FAZ9nCpDOqbRTrBL42aMGhfOWEyeA1x7+hl6JZfabBWAuf4nnCXuorKHzBXTrf7u7p
fXsKQClWRW77PF1VmzrtKNVSytQAmlCWApQIw20AarFipXmVdIjHmJPU611WoyxZPb4JTOxx
5cv9B+nr/RIB+v5dcStyHCCwO1be7nBDdCgd4F6kTQPLuQINBFfWTL4BEACnNA29e8TarUsB
L5n6eLZHXcFvVwNLVlirWOClHXf44o2KnN3ww+eBEmKVfEFo9MSuGDNHS8Zw1NiGMYxLIUgd
U6gGrVVs/VrQWL82pbMk6jCj98N+BXIri+6K1z+AImz7ax7iF1kDgRAnFWU0znWWBgM2mM8Y
gDjcxfXk4sCKnvf6Gjo08Ey5zmqx7dekAKU2EEp8Q1EJY3jbymLdZWRP4AFFMTS1rGMk0/tt
v71NBg1GobCcbNfn9chK/jhqxYhAJqq86RdJQkt3/9x1U1Oq0vXCt4JVVHmkxePtUiuWTTt+
aYlUAsKYZsWvncExvw77x2ArYDmaK0yfjh37wp0lY7DOJHFxoyT8tyWZlLci/VMRG2Ja33xj
0CN4C1yBg+QDeV3QFxQo42iA/ykdXPUR3ezmsND3XKvVLTC4DNb3V/EZQ7jBj64+bEK0VW4G
B31VP00ApNQvSoczsIOAKdk97RNbpmPw6q10ILIB+9T1xbnFYzshzGF17oC0/GENIHATx8vZ
masOZoDiOZQpeneLgnFE9JfzhLTxv6wNZcc/HLXRQVTkDsQr8ERtkAoHCf1E5+b5Yr7pfnE4
YuhET746o25S53ELUYPIs49qoJsEJL34/oexMfPGyPIlrbufiNyty5jc/1MRwUlhJlJ5IOHy
ZUa+6CLR7GdImusFkPJUJwARAQABiQI8BBgBAgAmAhsMFiEE0jZTh0IuwoTjmYHH+TPrQ98T
YR8FAlu6CHAFCQXE7zIACgkQ+TPrQ98TYR9nXxAAqNBgkYNyGuWUuy0GwDQCbu3iiMyH1+D7
llafPcK4NYy1Z4AYuVwC9nmLaoj+ozdqS3ncRo57ncRsKEJC46nDJJZYZ5LSJVn63Y3NBF86
lxQAgjj2oyZEwaLKtKbAFsXL43jv1pUGgSvWwYtDwHITXXFQto9rZEuUDRFSx4sg9OR+Q6/6
LY+nQQ3OdHlBkflzYMPcWgDcvcTAO6yasLEUf7UcYoSWTyMYjLB4QuNlXzTswzGVMssJF/vo
V8lD1eqqaSUWG3STF6GVLQOr1NLvN5+kUBiEStHFxBpgSCvYY9sNV8FS6N24CAWMBl+10W+D
2h1yiiP5dOdPcBDYKsgqDD91/sP0WdyMJkwdQJtD49f9f+lYloxHnSAxMleOpyscg1pldw+i
mPaUY1bmIknLhhkqfMmjywQOXpac5LRMibAAYkcB8v7y3kwELnt8mhqqZy6LUsqcWygNbH/W
K3GGt5tRpeIXeJ25x8gg5EBQ0Jnvp/IbBYQfPLtXH0Myq2QuAhk/1q2yEIbVjS+7iowEZNyE
56K63WBJxsJPB2mvmLgn98GqB4G6GufP1ndS0XDti/2K0o8rep9xoY/JDGi0n0L0tk9BHyoP
Y7kaEpu7UyY3nVdRLe5H1/MnFG8hdJ97WqnPS0buYZlrbTV0nRFL/NI2VABl18vEEXvNQiO+ vM8=
Message-ID: <d5f01da4-b9a7-67f1-860a-dcd7c354da40@intel.com>
Date: Wed, 27 Mar 2019 11:37:50 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <761FB0F2AB727F4FA9CE98D18810B0151B1F18AA@BGSMSX103.gar.corp.intel.com>
Content-Type: text/plain; charset="UTF-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [dpdk-dev] [PATCH v2] lib/cfgfile: replace strcat with strlcat
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>
Message-ID: <20190327113750.OKSJenCO_L65RQ3gQsqB5OaXvOn6zRd9x7P5pZ0FW1U@z>
On 3/26/2019 10:04 AM, Chaitanya Babu, TalluriX wrote:
> Hi
>
>> -----Original Message-----
>> From: Yigit, Ferruh
>> Sent: Friday, March 8, 2019 11:01 PM
>> To: Richardson, Bruce <bruce.richardson@intel.com>; Chaitanya Babu, TalluriX
>> <tallurix.chaitanya.babu@intel.com>
>> Cc: dev@dpdk.org; Pattan, Reshma <reshma.pattan@intel.com>;
>> Parthasarathy, JananeeX M <jananeex.m.parthasarathy@intel.com>;
>> Dumitrescu, Cristian <cristian.dumitrescu@intel.com>; stable@dpdk.org
>> Subject: Re: [PATCH v2] lib/cfgfile: replace strcat with strlcat
>>
>> On 3/8/2019 2:02 PM, Bruce Richardson wrote:
>>> On Fri, Mar 08, 2019 at 12:45:50PM +0000, Chaitanya Babu Talluri wrote:
>>>> Replace strcat with strlcat to avoid buffer overflow.
>>>>
>>>> Fixes: a6a47ac9c2 ("cfgfile: rework load function")
>>>> Cc: stable@dpdk.org
>>>>
>>>> Signed-off-by: Chaitanya Babu Talluri
>>>> <tallurix.chaitanya.babu@intel.com>
>>>> ---
>>>> v2: Instead of strcat, used strlcat.
>>>> ---
>>>> lib/librte_cfgfile/rte_cfgfile.c | 4 +++-
>>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/lib/librte_cfgfile/rte_cfgfile.c
>>>> b/lib/librte_cfgfile/rte_cfgfile.c
>>>> index 7d8c941ea..3296bb6f8 100644
>>>> --- a/lib/librte_cfgfile/rte_cfgfile.c
>>>> +++ b/lib/librte_cfgfile/rte_cfgfile.c
>>>> @@ -8,6 +8,7 @@
>>>> #include <ctype.h>
>>>> #include <errno.h>
>>>> #include <rte_common.h>
>>>> +#include <rte_string_fns.h>
>>>>
>>>> #include "rte_cfgfile.h"
>>>>
>>>> @@ -224,10 +225,11 @@ rte_cfgfile_load_with_params(const char
>> *filename, int flags,
>>>> _strip(split[1], strlen(split[1]));
>>>> char *end = memchr(split[1], '\\', strlen(split[1]));
>>>>
>>>> + size_t split_len = strlen(split[1]) + 1;
>>>> while (end != NULL) {
>>>> if (*(end+1) == params->comment_character)
>> {
>>>> *end = '\0';
>>>> - strcat(split[1], end+1);
>>>> + strlcat(split[1], end+1, split_len);
>>>
>>> I don't think this will do what you want. Remember that strlcat takes
>>> the total length of the buffer, which means that if split_len is set
>>> to the current length (as you do before the while statement), then
>>> passing that as the length parameter will cause strlcat to do nothing,
>>> since it sees the buffer as already full.
>>
>> The logic doesn't lengthen the 'split[1]' content, indeed it reduces the initial
>> size although it uses string concatenation, that is why it should be OK to use
>> 'split_len' here.
>>
>> What code does is, it finds specific char in 'split' buffer and removes it by
>> shifting remaining chars one byte to the left. So it shouldn't pass the initial size
>> of the buffer.
>>
>> There is a overlapping strings concern, which 'strcat' & 'strlcat' don't support,
>> but I guess it is OK here since we are sure that strings are separated by a
>> NULL, so where a char read and written should be different although overall
>> dst and src buffers overlap.
>
> Yes, although the same string is manipulated the split string (*end = '\0') is separated with NULL.
> Strlcat works fine here and expected concatenation is happening.
> If there are no further comments request for ACK please.
Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>