Message-ID: <53EB74E2.2070002@vmware.com>
Date: Wed, 13 Aug 2014 17:23:30 +0300
From: Heikki Linnakangas <hlinnakangas@vmware.com>
Organization: VMware
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:24.0) Gecko/20100101 Icedove/24.5.0
MIME-Version: 1.0
To: Kevin Grittner <kgrittn@ymail.com>, David Rowley <dgrowleyml@gmail.com>,
 Noah Misch <noah@leadboat.com>
CC: Alvaro Herrera <alvherre@2ndquadrant.com>, Tomas Vondra <tv@fuzzy.cz>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: strncpy is not a safe version of strcpy
References: 
 <CAApHDvoKSa-2yjdSfoFk8bC8A4QGfFb3f5R3LETJ_h_-Of1dPg@mail.gmail.com>
	<d94167312f15c401552b69b710c9c2e4.squirrel@sq.gransy.com>
	<CAApHDvoQ6rNPTBWJrz7_hRVm32yhRZU7mb+=yYXJkYnxpOqw7A@mail.gmail.com>
	<20131115150927.GA6220@eldon.alvh.no-ip.org>
	<CAApHDvrCrKSrx3WJSxN2-9FQJGYZMWtz-Nz9c4PWEMTYW8sdQg@mail.gmail.com>
	<20140813031918.GA286401@tornado.leadboat.com>
 <CAApHDvp6YM9tSBCLZOrA-P5oAWjoN-dDU7200O7wERsiG=9EYA@mail.gmail.com>
 <1407936691.21837.YahooMailNeo@web122301.mail.ne1.yahoo.com>
In-Reply-To: <1407936691.21837.YahooMailNeo@web122301.mail.ne1.yahoo.com>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 08/13/2014 04:31 PM, Kevin Grittner wrote:
> David Rowley <dgrowleyml@gmail.com> wrote:
>
>> I had a quick look at the usages of strncpy in master tonight and
>> I've really just picked out the obviously broken ones for now.
>> The other ones, on first look, either look safe, or require some
>> more analysis to see what's actually done with the string.
>>
>> Does anyone disagree with the 2 changes in the attached?
>
> I am concerned that failure to check for truncation could allow
> deletion of unexpected files or directories.  While this is
> probably not as dangerous as *executing* unexpected files, it seems
> potentially problematic.  At the very least, a code comment
> explaining why calling unlink on something which is not what
> appears to be expected is not a problem there.
>
> Some might consider it overkill, but I tend to draw a pretty hard
> line on deleting or executing random files, even if the odds seem
> to be that the mangled name won't find a match.  Granted, those
> problems exist now, but without checking for truncation it seems to
> me that we're just deleting *different* incorrect filenames, not
> really fixing the problem.

strlcpy is clearly better than strncpy here, but I wonder if we should 
have yet another string copying function that throws an error instead of 
truncating, if the buffer is too small. What you really want in these 
cases is a "path too long" error.

- Heikki


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers