Skip to contentSkip to conversation

Fix infinite loops in textfile.c

PATCH In review Ville Nuorvala 2 participants 2 messages Sep 9, 2005 – Sep 10, 2005 Bluetooth drivers

lore
Share & tools
lore

Ville Nuorvala

author
#0 lore raw

PATCH 1/1 Fix infinite loops in textfile.c

Hi,

both textfile_put() and textfile_get() go into inifinite loops if a string matching the search key is found anywhere except at the beginning of a line.

Both functions may also get false positive matches if the search key forms a substring of some other key in the same file.

The attached patch fixes both problems, but I can split it up into two separate parts if you wish.

Regards,
Ville

Signature · 5 lines
Ville Nuorvala
Research Assistant,
Laboratory for Theoretical Computer Science,
Helsinki University of Technology
email: [email protected], phone: +358 (0)9 451 5257

Index: common/textfile.c
===================================================================
RCS file: /cvsroot/bluez/utils/common/textfile.c,v retrieving revision 1.7

textfile.c +12 -25
diff -u -r1.7 textfile.c
@@ -113,6 +113,15 @@
 	return err;
 }
 
+static inline char *find_key(char *map, char *key, size_t len)
+{
+	char *off = strstr(map, key);
+
+	while (off && ((off > map && *(off - 1) != '\r' && *(off - 1) != '\n') || *(off + len) != ' '))
+		off = strstr(off + len, key);
+	return off;
+}
+
 int textfile_put(char *pathname, char *key, char *value)
 {
 	struct stat st;

@@ -148,7 +157,7 @@
 		goto unlock;
 	}
 
-	off = strstr(map, key);
+	off = find_key(map, key, strlen(key));
 	if (!off) {
 		munmap(map, size);
 		pos = lseek(fd, size, SEEK_SET);

@@ -156,18 +165,6 @@
 		goto unlock;
 	}
 
-	if (off > map) {
-		while (*(off - 1) != '\r' && *(off - 1) != '\n') {
-			off = strstr(off, key);
-			if (!off) {
-				munmap(map, size);
-				pos = lseek(fd, size, SEEK_SET);
-				err = write_key_value(fd, key, value);
-				goto unlock;
-			}
-		}
-	}
-
 	base = off - map;
 
 	end = strpbrk(off, "\r\n");

@@ -254,29 +251,19 @@
 		goto unlock;
 	}
 
-	off = strstr(map, key);
+	len = strlen(key);
+	off = find_key(map, key, len);
 	if (!off) {
 		err = EILSEQ;
 		goto unmap;
 	}
 
-	if (off > map) {
-		while (*(off - 1) != '\r' && *(off - 1) != '\n') {
-			off = strstr(off, key);
-			if (!off) {
-				err = EILSEQ;
-				goto unmap;
-			}
-		}
-	}
-
 	end = strpbrk(off, "\r\n");
 	if (!end) {
 		err = EILSEQ;
 		goto unmap;
 	}
 
-	len = strlen(key);
 	str = malloc(end - off - len);
 	if (!str) {
 		err = EILSEQ;
maintainer
#1 lore raw

Hi Ville,

Quoted 9 lines

both textfile_put() and textfile_get() go into inifinite loops if a string matching the search key is found anywhere except at the beginning of a line.

Both functions may also get false positive matches if the search key forms a substring of some other key in the same file.

The attached patch fixes both problems, but I can split it up into two separate parts if you wish.

no need to split it. Thanks for the patch. I applied it.

What do you think about writing some regression tests for the textfile library?

Regards

Marcel

-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel