Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Benjamin Kosnik]

The patch to fix this is pre-approved. Thanks for pointing it out.

-benjamin

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Phil Edwards]

On Mon, Sep 24, 2001 at 01:17:56PM -0700, Benjamin Kosnik wrote:
> 
> The patch to fix this is pre-approved. Thanks for pointing it out.

I'm wondering why it never shows up as a testsuite failure....


Phil

-- 
"You have to wonder what kind of life you have when your list of personal
rules begins with, '#3:  No drowning in your own mucus,' and '#4:  Don't
ask what happened to rules 1 and 2.'"

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Benjamin Kosnik]

I think it was on solaris. No matter. Phil, can you take care of this?

thanks

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Phil Edwards]

On Mon, Sep 24, 2001 at 02:30:34PM -0700, Benjamin Kosnik wrote:
> 
> I think it was on solaris. No matter. Phil, can you take care of this?

Sure.  Since it's testing C strings, I'll succumb to C Programmer's Disease
[q.v.] and just bump the size.

(Should we be doing anything with the character variables returned from
the various functions later in those tests?)

Trunk and branch.



2001-09-25  Phil Edwards  <pme@gcc.gnu.org>

	* testsuite/21_strings/c_strings.cc (test01, test02):  Increase
	`carray' size.


Index: testsuite/21_strings/c_strings.cc
===================================================================
RCS file: /cvs/gcc/gcc/libstdc++-v3/testsuite/21_strings/c_strings.cc,v
retrieving revision 1.5
diff -u -3 -p -r1.5 c_strings.cc
--- c_strings.cc	2001/05/25 01:33:21	1.5
+++ c_strings.cc	2001/09/26 01:42:30
@@ -33,7 +33,7 @@ void test01()
   const char* cc1 = &cc;
   const char* ccarray1 = "san francisco roof garden inspectors";
   const char* ccarray2 = "san francisco sunny-day park inspectors";
-  char carray[30];
+  char carray[50];
   std::strcpy(carray, ccarray1);
   void* v = carray;
   const void* cv = ccarray1;
@@ -70,7 +70,7 @@ void test02()
 
   const char* ccarray1 = "san francisco roof garden inspectors";
   const char* ccarray2 = "san francisco sunny-day park inspectors";
-  char carray[30];
+  char carray[50];
   strcpy(carray, ccarray1);
   void* v = carray;
   const void* cv = ccarray1;

Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Hans-Peter Nilsson]

Is this some C++ gotcha or is there an obvious buffer-overwrite
here?  The CRIS gcc port and the simulator dump says the buffer
is overwritten, but there's no absolute truth in that.

 ...
  const char* ccarray1 = "san francisco roof garden inspectors";
  const char* ccarray2 = "san francisco sunny-day park inspectors";
  char carray[30];
  std::strcpy(carray, ccarray1);
 ...

Will trade patch for clue.

brgds, H-P

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Rick Copeland]

Well, since strlen(ccarray1) == 36, and you're copying into a 30-byte 
array, it looks like an obvious buffer-overflow [write?].

Hans-Peter Nilsson wrote:

>Is this some C++ gotcha or is there an obvious buffer-overwrite
>here?  The CRIS gcc port and the simulator dump says the buffer
>is overwritten, but there's no absolute truth in that.
>
> ...
>  const char* ccarray1 = "san francisco roof garden inspectors";
>  const char* ccarray2 = "san francisco sunny-day park inspectors";
>  char carray[30];
>  std::strcpy(carray, ccarray1);
> ...
>
>Will trade patch for clue.
>
>brgds, H-P
>
>