You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Bryan O'Sullivan <bo...@serpentine.com> on 2001/11/21 06:17:35 UTC
Re: Possible bug in libsvn_ra_dav/commit.c? Any sprintf gurus
please look.
On Tue, 2001-11-20 at 21:38, B. W. Fitzpatrick wrote:
> So I look inside of apr_uuid_format. Basically it does an sprintf of
> uuid->data into uuid_buf. I checked... it's doing sprintf'ing 36
> bytes, and we've allocated 36 bytes, so all should be OK.
>
> And now, finally my questions:
> 1. Doesn't sprintf throw an \0 onto the end of the string [...]
Yes.
> 2. Shouldn't we allocate uuid_buf as [APR_UUID_FORMATTED_LENGTH +1] ?
Yes. Look, ma, I've stack-smashed myself!
> 3. Why doesn't this blow up on other platforms? Why oh why oh why?
My guess is that "other platforms" are just about all little-endian (in
fact, just about all x86, and probably just about all compiled with gcc
and the same bunch of compiler options), and you're getting lucky with
your stack alignment such that the low-order byte of the address of
uuid_buf happens to be zero. If it gets scribbled on by another zero
byte, no apparent problemo.
This looks like a misinterpretation of the meaning of
APR_UUID_FORMATTED_LENGTH by whoever wrote create_activity.
<b
Re: Possible bug in libsvn_ra_dav/commit.c? Any sprintf gurus please look.
Posted by Greg Stein <gs...@lyra.org>.
On Tue, Nov 20, 2001 at 10:17:35PM -0800, Bryan O'Sullivan wrote:
> On Tue, 2001-11-20 at 21:38, B. W. Fitzpatrick wrote:
>...
> > 2. Shouldn't we allocate uuid_buf as [APR_UUID_FORMATTED_LENGTH +1] ?
>
> Yes. Look, ma, I've stack-smashed myself!
Yup. Looks like that was already noted and checked in.
> > 3. Why doesn't this blow up on other platforms? Why oh why oh why?
>
> My guess is that "other platforms" are just about all little-endian (in
> fact, just about all x86, and probably just about all compiled with gcc
> and the same bunch of compiler options), and you're getting lucky with
> your stack alignment such that the low-order byte of the address of
> uuid_buf happens to be zero. If it gets scribbled on by another zero
> byte, no apparent problemo.
Right.
> This looks like a misinterpretation of the meaning of
> APR_UUID_FORMATTED_LENGTH by whoever wrote create_activity.
"whoever" would be me. And the saddest part is that I wrote create_activity
*and* the UUID functions in APR. Heck, I wrote the comment in apr_uuid.h
about needing to allocate LENGTH+1 bytes for the result!
Damn, I suck.
Cheers,
-g
--
Greg Stein, http://www.lyra.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org