Re: [Xen-devel] [PATCH 3 of 3 RESEND] libxl: Warn that /usr/bin/pygrub is deprecated

[Tim Deegan <tim@xxxxxxx>]

At 14:15 +0100 on 10 May (1336659339), Ian Jackson wrote:
> Tim Deegan writes ("Re: [Xen-devel] [PATCH 3 of 3 RESEND] libxl: Warn that 
> /usr/bin/pygrub is deprecated"):
> > At 12:36 +0100 on 10 May (1336653395), Ian Jackson wrote:
> > > Boggle.  Any such build processes need to be taken out and shot.
> > > There is nothing wrong with strcmp.  Are you sure you're not thinking
> > > of strcat or sprintf ?
> > 
> > If the user controlled both the length and contents of
> > info->u.pv.bootloader, it could cause this to overrun that buffer and
> > cause a SEGV.  So, sadly, strcmp goes on the 'just never use it' list
> > for many people.
> 
> info->u.pv.bootloader is a string.  The in-process caller of libxl
> is required to provide a nul-terminated buffer.  In general, strcmp is
> correct for user-provided strings when the string is a string.

Sure, in this case, strcmp is fine; I was talking about the reasons why
people are scared of it.

Tim.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel