dmesg: fix segfqult

dmesg: fix segfqult

[Marc-Antoine Perennou]

An element declared as size_t cannot be detected as negative (len < 0
is always false).
This can lead to an infinite loop causing a segmentation fault.
Use an int to solve this issue

Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
---
 sys-utils/dmesg.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/sys-utils/dmesg.c b/sys-utils/dmesg.c
index 867581d..91855a1 100644
--- a/sys-utils/dmesg.c
+++ b/sys-utils/dmesg.c
@@ -362,7 +362,7 @@ static void safe_fwrite(const char *buf, size_t
size, FILE *out)

 #ifdef HAVE_WIDECHAR
 		wchar_t wc;
-		size_t len = mbrtowc(&wc, p, size - i, &s);
+		int len = mbrtowc(&wc, p, size - i, &s);

 		if (len == 0)				/* L'\0' */
 			return;
-- 
1.7.6.134.gcf13f6.dirty

RE: dmesg: fix segfqult

[Voelker, Bernhard]

Marc-Antoine Perennou wrote:

> An element declared as size_t cannot be detected as negative (len < 0
> is always false).
> This can lead to an infinite loop causing a segmentation fault.
> Use an int to solve this issue
> 
> Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
> ---
>  sys-utils/dmesg.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/sys-utils/dmesg.c b/sys-utils/dmesg.c
> index 867581d..91855a1 100644
> --- a/sys-utils/dmesg.c
> +++ b/sys-utils/dmesg.c
> @@ -362,7 +362,7 @@ static void safe_fwrite(const char *buf, size_t
> size, FILE *out)
> 
>  #ifdef HAVE_WIDECHAR
>  		wchar_t wc;
> -		size_t len = mbrtowc(&wc, p, size - i, &s);
> +		int len = mbrtowc(&wc, p, size - i, &s);
> 
>  		if (len == 0)				/* L'\0' */
>  			return;
> -- 
> 1.7.6.134.gcf13f6.dirty
> --

Interestingly, there are other projects which fell into the same trap:
* mc: https://bugzilla.redhat.com/show_bug.cgi?id=150569 

Have a nice day,
Berny

Re: dmesg: fix segfqult

[Mike Frysinger]

On Mon, Jul 18, 2011 at 12:45, Marc-Antoine Perennou wrote:
> -               size_t len = mbrtowc(&wc, p, size - i, &s);
> +               int len = mbrtowc(&wc, p, size - i, &s);

this is wrong for systems where sizeof(size_t) != sizeof(int).  i
think you want to fix the code like the man page indicates ... do "if
(len < (size_t)-1) ....."
-mike

Re: dmesg: fix segfqult

[Mike Frysinger]

On Mon, Jul 18, 2011 at 14:11, Mike Frysinger wrote:
> On Mon, Jul 18, 2011 at 12:45, Marc-Antoine Perennou wrote:
>> -               size_t len = mbrtowc(&wc, p, size - i, &s);
>> +               int len = mbrtowc(&wc, p, size - i, &s);
>
> this is wrong for systems where sizeof(size_t) != sizeof(int).  i
> think you want to fix the code like the man page indicates ... do "if
> (len < (size_t)-1) ....."

err, something like "if (len == (size_t)-1) { /* handle error */ }"
-mike

Re: dmesg: fix segfqult

[Mike Frysinger]

and you can ignore me as i simply didnt finish going through my inbox
and you've already posted a v2 doing it right ;x
-mike