[sane-devel] [BUG] saned: missing input sanitization

2004-10-16 Thread Henning Meier-Geinitz
Hi, On Fri, Oct 15, 2004 at 03:47:40PM +0200, Johannes Berg wrote: SANE_NET_OPEN makes saned segfault if a NULL name is passed, because it tries to strdup() the name without checking for != NULL. I've added a check to CVS. It returns an error to the client because I think that's a protocol

[sane-devel] [BUG] saned: missing input sanitization

2004-10-16 Thread Johannes Berg
--=-RvFmJl5eUaAjiXBPw3Ib Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Sat, 2004-10-16 at 15:48 +0200, Henning Meier-Geinitz wrote: I've added a check to CVS. It returns an error to the client because I think that's a protocol violation. Zero-length strings are allowed

[sane-devel] [BUG] saned: missing input sanitization

2004-10-16 Thread Henning Meier-Geinitz
Hi, On Sat, Oct 16, 2004 at 04:01:20PM +0200, Johannes Berg wrote: I think the problem is that the network layer does not distinguish between zero-length strings and NULL pointers -- as far as I can see it interprets a zero-length string A zero length string is e.g. SANE_String hubba = ;

[sane-devel] [BUG] saned: missing input sanitization

2004-10-16 Thread Johannes Berg
--=-5n0e72bCo6NIQyEFjdhX Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Sat, 2004-10-16 at 16:10 +0200, Henning Meier-Geinitz wrote: For sane_net a zero-lenth string is 0 0 0 1 0 (Array of length 1 which only contains a 0 byte as end marker). Reading through the code

[sane-devel] [BUG] saned: missing input sanitization

2004-10-15 Thread Johannes Berg
--=-4jUAPFROJACgVt5tWrHO Content-Type: text/plain Content-Transfer-Encoding: quoted-printable SANE_NET_OPEN makes saned segfault if a NULL name is passed, because it tries to strdup() the name without checking for !=3D NULL. johannes --=-4jUAPFROJACgVt5tWrHO Content-Type: