[vdr] Re: BUG: vdr-streamdev

[Josef Wolf <jw@raven.inka.de>]

On Wed, Nov 10, 2004 at 08:44:20AM +0100, hm@seneca.muc.de wrote:
> Josef Wolf <jw@raven.inka.de> wrote:
> > On Thu, Nov 04, 2004 at 12:17:46PM +0100, hm@seneca.muc.de wrote:
> 
>>> if (strncasecmp (String, channel->Name(), strlen (channel->Name())) == 0) 
> 
>> Is it by intention that you use strncasecmp() instead of strcasecmp()?
>> Even when you favour strncasecmp() then the length should be evaluated
>> from String:
> 
>>  if (strncasecmp (String, channel->Name(), strlen (String)) == 0) 
> 
>> This way the first matching channel will be taken.
> 
> Yes but for security reasons I want to use the length of the string in
> channels.conf. "String" is taken verbatim from the data the user sends, and
> I don't want the user to be able to create buffer overflow side effects. 

Ough!  I can't see how to create a buffer overflow with strcmp() as long
as channel->Name() is terminated properly.  Assuming strlen(a)>strlen(b),
strncasecmp(a,b,strlen(a)) will stop comparing at the same position
at which strcasecmp(a,b) would stop: the '\0' that terminates b.

Thus, as long as channel->Name() is terminated properly, the user has no
way to create a buffer overflow. OTOH, when channel->Name() is _not_
terminated properly, then passing it to strlen() will blow up.  Using
strncasecmp() in the above example don't buy you anything as far as buffer
overflows are concerned.

> In general, you never want to use strcmp or strcasecmp, there were
> too many buffer overflow exploits (as for strcpy etc.). Always use "n"
> and proper buffer checking, e.g.  with malloc().

strcpy/strcat/malloc are a different story.  Don't confuse them with
str[n]cmp.

-- 
Please visit and sign and http://www.ffii.org
-- Josef Wolf -- jw@raven.inka.de --