[Bug 440853] New: opensc-0.11.6-1.29: undefined code
https://bugzilla.novell.com/show_bug.cgi?id=440853 Summary: opensc-0.11.6-1.29: undefined code Product: openSUSE 11.1 Version: Factory Platform: All OS/Version: openSUSE 11.0 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: dcb314@hotmail.com QAContact: qa@suse.de Found By: --- I just tried to build the OpenSuse factory package opensc-0.11.6-1.29 and the compiler said pkcs15-lib.c:3723: warning: operation on 'p' may be undefined The source code is if (p >= end || p + (n = *p++) > end) I agree with the compiler, the code is undefined. Suggest code rework. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=440853 Marcus Meissner <meissner@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |sbrabec@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=440853 User dcb314@hotmail.com added comment https://bugzilla.novell.com/show_bug.cgi?id=440853#c1 --- Comment #1 from David Binderman <dcb314@hotmail.com> 2009-03-05 04:56:52 MST --- I just checked version 0.11.6-5.22 and the code is still broken, some four months later. Your advice appreciated on how to best progress this bug report. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=440853 User sbrabec@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=440853#c2 Stanislav Brabec <sbrabec@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aj@dungeon.inka.de --- Comment #2 from Stanislav Brabec <sbrabec@novell.com> 2009-03-05 05:44:41 MST --- This may be a fix: --- src/pkcs15init/pkcs15-lib.c +++ src/pkcs15init/pkcs15-lib.c @@ -3723,9 +3723,10 @@ while (p < end && (tag = *p++) != 0 && tag != 0xFF) { int r = 0; - if (p >= end || p + (n = *p++) > end) + if (p >= end || p + (n = *p) > end) goto error; + p++; switch (tag) { case OPENSC_INFO_TAG_PROFILE: r = set_info_string(&profile->name, p, n); (This is not exact expansion, but in case of error p value is forgotten anyway.) Or expand the expression to a non-cryptic form: n = *p; if (p >= end || p + n > end) goto error; p++; (Again not exact expansion.) The expression two lines above look cryptic as well, but probably correct and defined behavior: p < end && (tag = *p++) != 0 && tag != 0xFF "(tag = *p++) != 0" should be executed after "p < end" and it can be understand as: tag = *p; p++; (tag != 0) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=440853 User sbrabec@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=440853#c3 Stanislav Brabec <sbrabec@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Status|NEW |ASSIGNED --- Comment #3 from Stanislav Brabec <sbrabec@novell.com> 2009-03-05 10:24:06 MST --- Cross-reference to the upstream mailing list: http://www.opensc-project.org/pipermail/opensc-devel/2009-March/011915.html And a reply from Andreas Jellinghaus intended for Bugzilla: From: Andreas Jellinghaus Subject: Re: [Bug 440853] opensc-0.11.6-1.29: undefined code Date: Thu, 5 Mar 2009 16:26:40 +0100 hu? I can't post a comment to the bug in bugzilla. maybe the behaviour is undefined, but it does not matter, because neither n or p are used, if "goto error" is executed (and both are local variables). here is the new code that should be ok: n = *p; p++; if (p >= end || p + n > end) goto error; since p is < end before the loop is started, we can read *p into n (variable for length of the tag). and we can increase p to point to the value. now p must be still smaller than end, and the last byte of the value (p+n) also must be end or smaller, so the result should be fine. Regards, Andreas -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com