From owner-freebsd-ipfw@FreeBSD.ORG Mon Nov 29 22:16:20 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 36E5616A4CE for ; Mon, 29 Nov 2004 22:16:20 +0000 (GMT) Received: from odin.ac.hmc.edu (Odin.AC.HMC.Edu [134.173.32.75]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0C72243D54 for ; Mon, 29 Nov 2004 22:16:20 +0000 (GMT) (envelope-from brdavis@odin.ac.hmc.edu) Received: from odin.ac.hmc.edu (localhost.localdomain [127.0.0.1]) by odin.ac.hmc.edu (8.13.0/8.13.0) with ESMTP id iATMH70v008328; Mon, 29 Nov 2004 14:17:07 -0800 Received: (from brdavis@localhost) by odin.ac.hmc.edu (8.13.0/8.13.0/Submit) id iATMH7dC008327; Mon, 29 Nov 2004 14:17:07 -0800 Date: Mon, 29 Nov 2004 14:17:07 -0800 From: Brooks Davis To: Charles Swiger Message-ID: <20041129221707.GA2571@odin.ac.hmc.edu> References: <20041129192514.GA7331@odin.ac.hmc.edu> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="UlVJffcvxoiEqYs2" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-Virus-Scanned: by amavisd-new X-Spam-Status: No, hits=0.0 required=8.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on odin.ac.hmc.edu cc: Brooks Davis cc: ipfw@freebsd.org Subject: Re: strncmp usage in ipfw X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Nov 2004 22:16:20 -0000 --UlVJffcvxoiEqYs2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Nov 29, 2004 at 03:26:12PM -0500, Charles Swiger wrote: > On Nov 29, 2004, at 2:25 PM, Brooks Davis wrote: > >char *var; > >if (!strncmp(var, "str", strlen(var))) > > ... > >[ ... ] > >Was use of this idiom deliberate or accidental? >=20 > I can't speak for the author, but using the "n"-for-length variant of=20 > the string and printf() family of functions is considered an important=20 > saftey practice, especially for network/firewall/IDS software which may= =20 > be exposed to externally generated data which contains deliberately=20 > malicious string lengths. That's true for string creation functions, but not for strncmp The only valid use of strncmp is to do comparisons between strings where one string is known to not be NUL-terminated or to look for a sub-string. It is not a safety function. > This brings me back to your point with regard to partial matches; it=20 > might be the case that the IPFW code could use char arrays and=20 > sizeof(var) rather than char *'s and strlen(var) for some cases? The=20 > former approach would not only address your concerns, Brooks, but also=20 > be faster. Otherwise, I suspect that: >=20 > char *var; > if (!strncmp(var, "str", strlen(var))) > ... >=20 > ...should become: >=20 > #define STR "str" > char *var; > if (!strncmp(var, STR, sizeof(STR))) > ... This is exactly equivalent in functionality to: char *var; if (!strcmp(var, "str")) ... We know that "str" is NUL-terminated because the C standard says it is so we will stop at or before the sizeof("str")th character. In either case we are not protected from the possibility that var contains a bogus string if the bogosity occurs before we get to the end of "str". In fact, there's no way to be sure of that except creating the string correctly in the first place! -- Brooks --=20 Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 --UlVJffcvxoiEqYs2 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFBq5/iXY6L6fI4GtQRAiC6AKCkR4REbX9HG+Cori0z2rjMLqMvzACfc8b6 MwUsxCXthWLuoam/GOQ7ZgQ= =CtBz -----END PGP SIGNATURE----- --UlVJffcvxoiEqYs2--