I wrote: > I tried out a "security checker" today that supposedly looks for > security-related properties of code. It mostly produced nonsense, but > it did find this: in sound.c, line 645, we do a strcpy. We are copying > into a stack buffer of fixed size (255 bytes). We are copying from > h->h_name, where h is a struct hostent * returned by gethostbyname(). > Do we actually know that h->h_name must be 254 (+ 1 null terminator) > characters long or less? I don't see anything on the gethostbyname man > page that so indicates. Vladimir Ivanovic wrote to tell me that he sees various definitions of MAXHOSTNAMELEN, including 32, 64, and 255. He also pointed out that POSIX defines a bound. According to the current POSIX spec, platforms may define a constant named HOST_NAME_MAX in <limits.h> that gives the length of the largest string that gethostbyname() will return. It also states that they may fail to define that constant, in which case you have to use sysconf() to find the right value. If HOST_NAME_MAX is defined, then it must be no smaller than 255. The upshot is that overrunning the buffer is unlikely, but possible, since some systems may support host names of length > 255. Well, 254, with the code in its present state. Thanks Vladimir!

>>>> "james" == Jerry James <james(a)xemacs.org&gt; writes:

P.S. I was going to comment that it's unlikely but possible for the host name length (is that the entire hostname+domainname or just the hostname-domainname?) to be more than 255 characters in length.

I wrote: > I tried out a "security checker" today that supposedly looks for > security-related properties of code. It mostly produced nonsense, but > it did find this: in sound.c, line 645, we do a strcpy. We are copying > into a stack buffer of fixed size (255 bytes). We are copying from > h->h_name, where h is a struct hostent * returned by gethostbyname(). > Do we actually know that h->h_name must be 254 (+ 1 null terminator) > characters long or less? I don't see anything on the gethostbyname man > page that so indicates. Vladimir Ivanovic wrote to tell me that he sees various definitions of MAXHOSTNAMELEN, including 32, 64, and 255. He also pointed out that POSIX defines a bound. According to the current POSIX spec, platforms may define a constant named HOST_NAME_MAX in <limits.h> that gives the length of the largest string that gethostbyname() will return. It also states that they may fail to define that constant, in which case you have to use sysconf() to find the right value. If HOST_NAME_MAX is defined, then it must be no smaller than 255. The upshot is that overrunning the buffer is unlikely, but possible, since some systems may support host names of length > 255. Well, 254, with the code in its present state. Thanks Vladimir!

"Vladimir G. Ivanovic" <vgivanovic(a)comcast.net&gt; wrote: > What checkers have you used? Here are the checkers I've tried out in my 2.5 weeks at the JPL: Uno: http://spinroot.com/uno/ sparse: http://freshmeat.net/projects/sparse/ CIL: http://cil.sourceforge.net/ splint: http://www.splint.org/ FlawFinder: http://www.dwheeler.com/flawfinder/ Real Soon Now I am going to try: ITS4: http://www.cigital.com/its4/ MOPS: http://www.cs.berkeley.edu/~daw/mops/ There are lots more to try, of course. Some of the ones listed above (like splint) are completely ineffective on the XEmacs sources for one reason or another. (Splint produces too much output when used with unannotated source code; writing the annotations for that much code would be a major project.) The JPL has licenses for some commercial checkers, such as the coverity and klockwork tools, but I'm not sure if I can legitimately use those on XEmacs, since it isn't directly related to JPL business. I'll have to ask. Or maybe we could get the coverity people to donate a code scan, since the US Department of Homeland Security is paying them to improve the state of open source software. > I noticed that in a recent Scientific American, there was discussion of > a number of model checkers. Have you applied any of them to XEmacs? No, I have not. Model checkers can be very effective at finding design flaws, but you have to build the model first. There are some tools now for extracting models from source code, but I have not tried any of them yet. Note that MOPS, which I mentioned above, uses a model checking approach. > P.S. When I ran 'make check' I got some errors. I haven't checked to see > if they've been reported. There are some known failures. See if the output says "KNOWN BUG"; if not, please tell us about the failures.