Properly handle \0 delimited string lists
PATCH 1/1 Properly handle \0 delimited string lists
reserved-names="res1\0res2\0res3";
Is valid DTS. This one-liner expands data based on the len given by the lexer instead of strlen.
Without this patch, realloc gets confused and hangs. For example:
*** Error in `./dtc': realloc(): invalid next size: 0x0000000001961670
***
--- data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
data.c +1 -1
@@ -74,7 +74,7 @@ struct data data_copy_escape_string(const char *s, int len)struct data d;char *q; - d =data_grow_for (empty_data,strlen (s)+1 ); + d =data_grow_for (empty_data, len +1 ); q = d.val;while (i < len) {
Signature · 6 lines
2.0.0 -- To unsubscribe from this list: send the line "unsubscribe devicetree-compiler" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
A message that is not in the archive (sent off-list or not yet received): 1402430256-8359-1-git-send-email-jack-jZyo8ZIaZD9AfugRpC6u6w@public.gmane.org
Hi Jack,
Long time no see :).
Quoted 9 lines · Jack Miller
reserved-names="res1\0res2\0res3";
Is valid DTS. This one-liner expands data based on the len given by the lexer instead of strlen.
Without this patch, realloc gets confused and hangs. For example:
*** Error in `./dtc':
realloc(): invalid next size:0x0000000001961670
***
So.. the patch certainly isn't wrong, and is arguably safer than the current version.
But.. I haven't been able to reproduce the problem, and I don't really see how it would occur in the first place.
The thing we're taking a strlen of is the input with it's escapes, so it won't have NULs, just backslashes and 0 digits.
Or am I missing something?
Signature · 4 lines
David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson
Quoted 3 lines · David Gibson
Hi Jack,
Long time no see :).
Yeah, I was pretty pleased to have an excuse to send something your way =)
Quoted 15 lines · Jack Miller
Quoted 9 lines
reserved-names="res1\0res2\0res3";
Is valid DTS. This one-liner expands data based on the len given by the lexer instead of strlen.
Without this patch, realloc gets confused and hangs. For example:
*** Error in `./dtc':
realloc(): invalid next size:0x0000000001961670
***So.. the patch certainly isn't wrong, and is arguably safer than the current version.
Quoted 7 lines
But.. I haven't been able to reproduce the problem, and I don't really see how it would occur in the first place.
The thing we're taking a strlen of is the input with it's escapes, so it won't have NULs, just backslashes and 0 digits.
Or am I missing something?
Sorry, I was unclear. The \0 was my short hand for a real embedded NULL character, which may be intentionally wrong-headed, but I don't think it's invalid (or if it is invalid, should at least not cause the compiler to do bad things).
In refining my testcase I realized that it doesn't fail on realloc with all bad input, but it does generate mangled output otherwise.
I've uploaded two short .dts snippets just because pasting NULLs into an email seems like a bad idea:
http://codezen.org/static/broken-dts.tar.gz
One causes the realloc, the other causes the mangled output on git HEAD. Both are working properly with my patch.
- Jack
--
To unsubscribe from this list: send the line "unsubscribe devicetree-compiler" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
A message that is not in the archive (sent off-list or not yet received): 20140612224728.GA17938-O8SCTCEbm15XsEFxtoW7CMxtgHpCUUYS@public.gmane.org
Quoted 28 lines · Jack Miller
Quoted 3 lines · David Gibson
Hi Jack,
Long time no see :).
Yeah, I was pretty pleased to have an excuse to send something your way =)
Quoted 21 lines · Jack Miller
Quoted 9 lines
reserved-names="res1\0res2\0res3";
Is valid DTS. This one-liner expands data based on the len given by the lexer instead of strlen.
Without this patch, realloc gets confused and hangs. For example:
*** Error in `./dtc':
realloc(): invalid next size:0x0000000001961670
***So.. the patch certainly isn't wrong, and is arguably safer than the current version.
But.. I haven't been able to reproduce the problem, and I don't really see how it would occur in the first place.
The thing we're taking a strlen of is the input with it's escapes, so it won't have NULs, just backslashes and 0 digits.
Quoted 6 lines
Quoted 1 line
Or am I missing something?
Sorry, I was unclear. The \0 was my short hand for a real embedded NULL character, which may be intentionally wrong-headed, but I don't think it's invalid (or if it is invalid, should at least not cause the compiler to do bad things).
Ah, I see.
Yes, NULs in the input is a bit perverse, but I don't see any reason it should be invalid.
Quoted 10 lines
In refining my testcase I realized that it doesn't fail on realloc with all bad input, but it does generate mangled output otherwise.
I've uploaded two short .dts snippets just because pasting NULLs into an email seems like a bad idea:
http://codezen.org/static/broken-dts.tar.gz
One causes the realloc, the other causes the mangled output on git HEAD. Both are working properly with my patch.
Ok. Could you make those into a testcase?
Signature · 4 lines
David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson