Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Hans-Peter Nilsson]

Is this some C++ gotcha or is there an obvious buffer-overwrite
here?  The CRIS gcc port and the simulator dump says the buffer
is overwritten, but there's no absolute truth in that.

 ...
  const char* ccarray1 = "san francisco roof garden inspectors";
  const char* ccarray2 = "san francisco sunny-day park inspectors";
  char carray[30];
  std::strcpy(carray, ccarray1);
 ...

Will trade patch for clue.

brgds, H-P

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.cc?

[Rick Copeland]

Well, since strlen(ccarray1) == 36, and you're copying into a 30-byte 
array, it looks like an obvious buffer-overflow [write?].

Hans-Peter Nilsson wrote:

>Is this some C++ gotcha or is there an obvious buffer-overwrite
>here?  The CRIS gcc port and the simulator dump says the buffer
>is overwritten, but there's no absolute truth in that.
>
> ...
>  const char* ccarray1 = "san francisco roof garden inspectors";
>  const char* ccarray2 = "san francisco sunny-day park inspectors";
>  char carray[30];
>  std::strcpy(carray, ccarray1);
> ...
>
>Will trade patch for clue.
>
>brgds, H-P
>
>

RE: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.c

[Greg Hosler]

On 24-Sep-2001 Hans-Peter Nilsson wrote:
> Is this some C++ gotcha or is there an obvious buffer-overwrite
> here?  The CRIS gcc port and the simulator dump says the buffer
> is overwritten, but there's no absolute truth in that.
> 
>  ...
>   const char* ccarray1 = "san francisco roof garden inspectors";
>   const char* ccarray2 = "san francisco sunny-day park inspectors";
>   char carray[30];
>   std::strcpy(carray, ccarray1);
>  ...
> 
> Will trade patch for clue.

how do you fit 37 characters (i.e. strlen(ccarray1) + 1 for the null)
into 30 char buffer (size of carray), without overflowing it ?

-G

+---------------------------------------------------------------------+
   You can release software that's good, software that's inexpensive, or
   software that's available on time.  You can usually release software
   that has 2 of these 3 attributes -- but not all 3.
| Greg Hosler                                   hosler@lugs.org.sg    |
+---------------------------------------------------------------------+

Re: Buffer overwrite in libstdc++-v3 test 21_strings/c_strings.c

[Hans-Peter Nilsson]

> Date: Mon, 24 Sep 2001 22:24:35 +0800 (SGT)
> From: Greg Hosler <hosler@lugs.org.sg>

> On 24-Sep-2001 Hans-Peter Nilsson wrote:
> > Is this some C++ gotcha or is there an obvious buffer-overwrite
> > here?  The CRIS gcc port and the simulator dump says the buffer
> > is overwritten, but there's no absolute truth in that.
> > 
> >  ...
> >   const char* ccarray1 = "san francisco roof garden inspectors";
> >   const char* ccarray2 = "san francisco sunny-day park inspectors";
> >   char carray[30];
> >   std::strcpy(carray, ccarray1);
> >  ...
> > 
> > Will trade patch for clue.
> 
> how do you fit 37 characters (i.e. strlen(ccarray1) + 1 for the null)
> into 30 char buffer (size of carray), without overflowing it ?

That's the question I'm asking.  But presumably some corner in
that pile of papers called a C++ standards document could
interpret to say that strcpy should "DWIM" here.  Anyway, since
now two people see the same thing I do, enough said.

brgds, H-P