Skip to content
Snippets Groups Projects
Select Git revision
0 results

trees-common.c

  • David Goulet's avatar
    e9c45886
    Remove buggy use of trees_password_fd · e9c45886
    David Goulet authored
    
    Tomasz Miąsko reported multiple issues with the trees_read_line_fd using
    the trees_password_fd field. It is currently unused which used to be
    used by the unit tests and dovadm in the Posteo scrambler plugin.
    
    The issues are:
    
        In trees_read_line_fd(), this check is bad:
    
            if (bytes_read > MAXIMAL_PASSWORD_LENGTH)
    
        Currently it is incorrect because when "bytes_read >
        MAXIMAL_PASSWORD_LENGTH" is true, then buffer capacity is already
        exceeded (or just right if you take into account one byte slack
        allocated in str_new for terminating null). Moreover, the buffer
        will be overrun by one more byte in "pointer[0] = 0;" after leaving
        the loop.
    
    Reported-by: default avatarTomasz Miąsko <tomasz.miasko@gmail.com>
    Signed-off-by: default avatarDavid Goulet <dgoulet@riseup.net>
    e9c45886
    History
    Remove buggy use of trees_password_fd
    David Goulet authored
    
    Tomasz Miąsko reported multiple issues with the trees_read_line_fd using
    the trees_password_fd field. It is currently unused which used to be
    used by the unit tests and dovadm in the Posteo scrambler plugin.
    
    The issues are:
    
        In trees_read_line_fd(), this check is bad:
    
            if (bytes_read > MAXIMAL_PASSWORD_LENGTH)
    
        Currently it is incorrect because when "bytes_read >
        MAXIMAL_PASSWORD_LENGTH" is true, then buffer capacity is already
        exceeded (or just right if you take into account one byte slack
        allocated in str_new for terminating null). Moreover, the buffer
        will be overrun by one more byte in "pointer[0] = 0;" after leaving
        the loop.
    
    Reported-by: default avatarTomasz Miąsko <tomasz.miasko@gmail.com>
    Signed-off-by: default avatarDavid Goulet <dgoulet@riseup.net>