Messages in this thread | | | From | (David Wagner) | Subject | Re: macro conflict | Date | 24 Aug 2001 18:20:19 GMT |
| |
Richard B. Johnson wrote: >Looking through the code, min() is most always used to find some value >that will not overflow some buffer, i.e., > > len = min(user_request_len, sizeof(buffer)); > >The problem is that sizeof() returns an unsigned int (size_t), and the >user request length may be an integer. Everything works fine until >you get to lengths with the high bit set. Then, you are in trouble. > >In this case, you could have a 'min()' that does: > >#define min(a,b) (unsigned long)(a) < (unsigned long)(b) ? (a) : (b) > >... where the comparison (only) is made unsigned, and you keep the >original values. This should work, perhaps in all the current uses.
Just a small warning: If anyone writes something like int len = min(user_request_len, sizeof(buffer)); if (user_request_len > len) goto fail; memcpy(dst, user_src, len); they can get into trouble even with your min() macro. Ok, maybe this is crazy code that noone in their right mind would ever write.
This is not intended as a criticism -- your approach may be sufficient for existing code -- but it is something to watch out for. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |