From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 4255 invoked by alias); 19 Feb 2003 03:46:00 -0000 Mailing-List: contact gcc-prs-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Archive: List-Post: List-Help: Sender: gcc-prs-owner@gcc.gnu.org Received: (qmail 4237 invoked by uid 71); 19 Feb 2003 03:46:00 -0000 Resent-Date: 19 Feb 2003 03:46:00 -0000 Resent-Message-ID: <20030219034600.4235.qmail@sources.redhat.com> Resent-From: gcc-gnats@gcc.gnu.org (GNATS Filer) Resent-Cc: gcc-prs@gcc.gnu.org, gcc-bugs@gcc.gnu.org Resent-Reply-To: gcc-gnats@gcc.gnu.org, john.carter@tait.co.nz Received: (qmail 3772 invoked by uid 48); 19 Feb 2003 03:43:49 -0000 Message-Id: <20030219034349.3771.qmail@sources.redhat.com> Date: Wed, 19 Feb 2003 03:46:00 -0000 From: john.carter@tait.co.nz Reply-To: john.carter@tait.co.nz To: gcc-gnats@gcc.gnu.org X-Send-Pr-Version: gnatsweb-2.9.3 (1.1.1.1.2.31) Subject: libobjc/9751: malloc of strlen, not strlen+1 X-SW-Source: 2003-02/txt/msg00874.txt.bz2 List-Id: >Number: 9751 >Category: libobjc >Synopsis: malloc of strlen, not strlen+1 >Confidential: no >Severity: non-critical >Priority: low >Responsible: unassigned >State: open >Class: sw-bug >Submitter-Id: net >Arrival-Date: Wed Feb 19 03:46:00 UTC 2003 >Closed-Date: >Last-Modified: >Originator: john.carter@tait.co.nz >Release: gcc-3.2.2 >Organization: >Environment: all >Description: In file /gcc-3.2.1/libobjc/gc.c line 415 there is the following (possibly buggy?) code... /* The variable is gc_invisible and we have to reverse it */ new_type = objc_atomic_malloc (strlen (ivar->ivar_type)); strncpy (new_type, ivar->ivar_type, (size_t)(type - ivar->ivar_type)); strcat (new_type, type + 1); ivar->ivar_type = new_type; Probably that should be malloc(strlen()+1) for the null. Also strncpy is an fugly beast that almost always doesn't do what you want. ie. Will there always be a null termination in the right place for the following strcat()? >How-To-Repeat: Found using my collection of perl regex's for finding standard "gotcha's" >Fix: >Release-Note: >Audit-Trail: >Unformatted: