Messages in this thread | | | Date | Mon, 21 Mar 2011 21:28:41 +0100 (CET) | From | Jesper Juhl <> | Subject | Re: [PATCH][RFC] HPFS: Don't use pointer to out-of-scope array |
| |
On Thu, 6 Jan 2011, Jesper Juhl wrote:
> On Fri, 24 Dec 2010, Jesper Juhl wrote: > > > On Fri, 24 Dec 2010, Andreas Schwab wrote: > > > > > Jesper Juhl <jj@chaosbits.net> writes: > > > > > > > Secondly I fail to see how this code inside the while loop can even work: > > > > > > > > if (hpfs_ea_read(s, a, ano, pos + 4, ea->namelen + 1 + (ea->indirect ? 8 : 0), ex + 4)) > > > > > > > > There is nothing initializing 'ex' which 'ea' points to, so > > > > 'ea->namelen' and 'ea->indirect' are uninitialized. > > > > > > The preceding hpfs_ea_read should do it (it reads the first 4 bytes of > > > ex which aliases ea->namelen and ea->indirect). > > > > > How I managed to miss that I don't know, but I did and you are correct. > > Thanks. > > > But, this bit: "in the 'while (pos < len)' loop a local char array 'ex' is > defined and subsequently the pointer variable 'ea' is set to point to the > array. Inside the loop we may jump to the 'indirect' label which is > outside the loop scope. At the 'indirect' label 'ea' (which now points > to a array that is no longer in scope) is dereferenced - that's not good. > The patch below addresses that problem by moving the 'ex' array out of > the loop scope and into function scope." > I still believe to be correct and that's what the patch actually > addresses, so can we agree that the patch makes sense and should be > merged? > Ping?
-- Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/ Don't top-post http://www.catb.org/jargon/html/T/top-post.html Plain text mails only, please.
| |