Re: [LTP] [PATCH] fix buffer overflow in sem_getvalue tests

[Garrett C. <yan...@gm...>]

On Thu, Feb 18, 2010 at 9:50 AM, Cyril Hrubis <ch...@su...> wrote:
> Hi!
>> 1. Why 64?
>
> Well, it's big enough to hold the string (I'm too lazy to figure out exact
> maximal length for every possible architecture/compiler) and a few more bytes
> should not kill anyone...

SEM_NAME_MAX (see
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/topic/apis/ipcsemo.htm
)?

This doesn't appear to exist on older versions of Linux (RHEL 4.6 for
instance...)

The logic required to determine SEM_NAME_MAX should be easy to grab,
or you could follow the following logic from the sem_open manpage:

       ENAMETOOLONG
              The length of the name argument exceeds {PATH_MAX} or  a  path-
              name component is longer than {NAME_MAX}.

>> 2. It should be #define'd and/or sizeof should be used in snprintf
>> because they're fixed array buffers...
>
> Now there is sizeof() used in snprintf().

The rest of the patch looks ok ;)...

Thanks!
-Garrett