* [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member
@ 2020-07-13 11:15 Phil Sutter
2020-07-15 18:14 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Phil Sutter @ 2020-07-13 11:15 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
Recent versions of gcc started to complain about the old-style
zero-length array as last member of structs ipt_replace and
ip6t_replace. For instance, while compiling iptables:
| In file included from /usr/include/string.h:495,
| from libip4tc.c:15:
| In function 'memcpy',
| inlined from 'iptcc_compile_chain' at libiptc.c:1172:2,
| inlined from 'iptcc_compile_table' at libiptc.c:1243:13,
| inlined from 'iptc_commit' at libiptc.c:2572:8,
| inlined from 'iptc_commit' at libiptc.c:2510:1:
| /usr/include/bits/string_fortified.h:34:10: warning: writing 16 bytes into a region of size 0 [-Wstringop-overflow=]
| 34 | return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest));
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| In file included from ../include/libiptc/libiptc.h:12,
| from libip4tc.c:29:
| libiptc.c: In function 'iptc_commit':
| ../include/linux/netfilter_ipv4/ip_tables.h:202:19: note: at offset 0 to object 'entries' with size 0 declared here
| 202 | struct ipt_entry entries[0];
| | ^~~~~~~
(Similar for libip6tc.c.)
Avoid this warning by declaring 'entries' as an ISO C99 flexible array
member. This makes gcc aware of the intended use and enables sanity
checking as described in:
https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
include/uapi/linux/netfilter_ipv4/ip_tables.h | 2 +-
include/uapi/linux/netfilter_ipv6/ip6_tables.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
index 50c7fee625ae9..1a298cc7a29c1 100644
--- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
+++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
@@ -203,7 +203,7 @@ struct ipt_replace {
struct xt_counters __user *counters;
/* The entries (hang off end: not really an array). */
- struct ipt_entry entries[0];
+ struct ipt_entry entries[];
};
/* The argument to IPT_SO_GET_ENTRIES. */
diff --git a/include/uapi/linux/netfilter_ipv6/ip6_tables.h b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
index d9e364f96a5cf..623d84a169efd 100644
--- a/include/uapi/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/uapi/linux/netfilter_ipv6/ip6_tables.h
@@ -243,7 +243,7 @@ struct ip6t_replace {
struct xt_counters __user *counters;
/* The entries (hang off end: not really an array). */
- struct ip6t_entry entries[0];
+ struct ip6t_entry entries[];
};
/* The argument to IP6T_SO_GET_ENTRIES. */
--
2.27.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member
2020-07-13 11:15 [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member Phil Sutter
@ 2020-07-15 18:14 ` Pablo Neira Ayuso
2020-07-17 10:06 ` Phil Sutter
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-07-15 18:14 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel
Hi Phil,
On Mon, Jul 13, 2020 at 01:15:52PM +0200, Phil Sutter wrote:
[...]
> Avoid this warning by declaring 'entries' as an ISO C99 flexible array
> member. This makes gcc aware of the intended use and enables sanity
> checking as described in:
> https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
>
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> include/uapi/linux/netfilter_ipv4/ip_tables.h | 2 +-
> include/uapi/linux/netfilter_ipv6/ip6_tables.h | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> index 50c7fee625ae9..1a298cc7a29c1 100644
> --- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
> +++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> @@ -203,7 +203,7 @@ struct ipt_replace {
> struct xt_counters __user *counters;
>
> /* The entries (hang off end: not really an array). */
> - struct ipt_entry entries[0];
> + struct ipt_entry entries[];
arpt_replace uses this idiom too.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member
2020-07-15 18:14 ` Pablo Neira Ayuso
@ 2020-07-17 10:06 ` Phil Sutter
2020-07-17 10:20 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Phil Sutter @ 2020-07-17 10:06 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
Hi Pablo,
On Wed, Jul 15, 2020 at 08:14:33PM +0200, Pablo Neira Ayuso wrote:
> On Mon, Jul 13, 2020 at 01:15:52PM +0200, Phil Sutter wrote:
> [...]
> > Avoid this warning by declaring 'entries' as an ISO C99 flexible array
> > member. This makes gcc aware of the intended use and enables sanity
> > checking as described in:
> > https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
> >
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> > include/uapi/linux/netfilter_ipv4/ip_tables.h | 2 +-
> > include/uapi/linux/netfilter_ipv6/ip6_tables.h | 2 +-
> > 2 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > index 50c7fee625ae9..1a298cc7a29c1 100644
> > --- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > +++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > @@ -203,7 +203,7 @@ struct ipt_replace {
> > struct xt_counters __user *counters;
> >
> > /* The entries (hang off end: not really an array). */
> > - struct ipt_entry entries[0];
> > + struct ipt_entry entries[];
>
> arpt_replace uses this idiom too.
Oh, indeed. I focussed on those cases gcc complained about when
compiling iptables. Grepping for '\[0\]' in all of
include/uapi/linux/netfilter* reveals a few more cases. Do you think
it's worth "fixing" those as well?
Thanks, Phil
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member
2020-07-17 10:06 ` Phil Sutter
@ 2020-07-17 10:20 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-07-17 10:20 UTC (permalink / raw)
To: Phil Sutter, netfilter-devel
On Fri, Jul 17, 2020 at 12:06:48PM +0200, Phil Sutter wrote:
> Hi Pablo,
>
> On Wed, Jul 15, 2020 at 08:14:33PM +0200, Pablo Neira Ayuso wrote:
> > On Mon, Jul 13, 2020 at 01:15:52PM +0200, Phil Sutter wrote:
> > [...]
> > > Avoid this warning by declaring 'entries' as an ISO C99 flexible array
> > > member. This makes gcc aware of the intended use and enables sanity
> > > checking as described in:
> > > https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
> > >
> > > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > > ---
> > > include/uapi/linux/netfilter_ipv4/ip_tables.h | 2 +-
> > > include/uapi/linux/netfilter_ipv6/ip6_tables.h | 2 +-
> > > 2 files changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/include/uapi/linux/netfilter_ipv4/ip_tables.h b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > > index 50c7fee625ae9..1a298cc7a29c1 100644
> > > --- a/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > > +++ b/include/uapi/linux/netfilter_ipv4/ip_tables.h
> > > @@ -203,7 +203,7 @@ struct ipt_replace {
> > > struct xt_counters __user *counters;
> > >
> > > /* The entries (hang off end: not really an array). */
> > > - struct ipt_entry entries[0];
> > > + struct ipt_entry entries[];
> >
> > arpt_replace uses this idiom too.
>
> Oh, indeed. I focussed on those cases gcc complained about when
> compiling iptables. Grepping for '\[0\]' in all of
> include/uapi/linux/netfilter* reveals a few more cases. Do you think
> it's worth "fixing" those as well?
It seems this patch was missing a few spots, right?
commit 6daf14140129d30207ed6a0a69851fa6a3636bda
Author: Gustavo A. R. Silva <gustavo@embeddedor.com>
Date: Thu Feb 20 07:59:14 2020 -0600
netfilter: Replace zero-length array with flexible-array member
Probably Cc: Gustavo to confirm this.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-07-17 10:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-13 11:15 [nf-next PATCH] netfilter: include: uapi: Use C99 flexible array member Phil Sutter
2020-07-15 18:14 ` Pablo Neira Ayuso
2020-07-17 10:06 ` Phil Sutter
2020-07-17 10:20 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).