Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-23 Thread Wes Hardaker
Niels Baggesen writes: >> - It's considered a good programming practice to terminate strings >>properly that are announced as '\0'-terminated. > > SNMP OCTET STRINGS are not C strings, they are completely different > beasts. They should not be confused. Yes, but there is one thing to consid

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-23 Thread Wes Hardaker
Dave Shield writes: >> Probably the module/code you are discussing is only used on BSD >> or there is an implementation of strlcpy somewhere in net-snmp for >> systems without. > > The second is actually true. (See snmplib/strlcpy.c) Yep, and because we're using it in lots of places and we hav

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-22 Thread Dave Shield
On 22 August 2012 09:11, Schmoll Walter wrote: > ... as far as I know, strlcpy is not standard and only available on BSD > related > systems and slightly incompatible on Solaris (the return value is different) > but not on Linux related systems nor on Windows (just checked with my Ubuntu > 10.04

RE: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-22 Thread Schmoll Walter
>> Although I'd prefer that strncpy() to be replaced by strlcpy(): Probably I shouldn't meddle with this argument as I do know little about the project, but as far as I know, strlcpy is not standard and only available on BSD related systems and slightly incompatible on Solaris (the return value

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-21 Thread Niels Baggesen
Den 20-08-2012 18:39, Bart Van Assche skrev: > My arguments are: > - It's considered a good programming practice to terminate strings >properly that are announced as '\0'-terminated. SNMP OCTET STRINGS are not C strings, they are completely different beasts. They should not be confused. > -

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-20 Thread Bart Van Assche
On 08/20/12 10:31, Niels Baggesen wrote: > On Mon, Aug 20, 2012 at 08:56:27AM +, Bart Van Assche wrote: >> On 08/20/12 06:36, Niels Baggesen wrote: >>> This fixes a possible memory overrun (see patch 3559417) >> >> Although I'd prefer that strncpy() to be replaced by strlcpy(): > > Why? > > I

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-20 Thread Niels Baggesen
On Mon, Aug 20, 2012 at 08:56:27AM +, Bart Van Assche wrote: > On 08/20/12 06:36, Niels Baggesen wrote: > > This fixes a possible memory overrun (see patch 3559417) > > Although I'd prefer that strncpy() to be replaced by strlcpy(): Why? It's a convenience, yes, but it leads to results being

Re: CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-20 Thread Bart Van Assche
On 08/20/12 06:36, Niels Baggesen wrote: > This fixes a possible memory overrun (see patch 3559417) Although I'd prefer that strncpy() to be replaced by strlcpy(): +1 Bart. -- Live Security Virtual Conference Exclusive

CFV: Fix possible memory overrun in fsys_getfsstats.c

2012-08-19 Thread Niels Baggesen
This fixes a possible memory overrun (see patch 3559417) /Niels -- Niels Baggesen - @home - Ã…rhus - Denmark - n...@users.sourceforge.net The purpose of computing is insight, not numbers --- R W Hamming diff --git a/agent/mibgroup/hardware/fsys/fsys_getfsstats.c b/agent/mibgroup/hardware/fsy