code review 7876044: cmd/cc, cmd/ld: do not overflow strings in symbol lookup.

cmd/cc, cmd/ld: do not overflow strings in symbol lookup.

[remyoudompheng, 2013-03-24 08:42:58]

Hello golang-dev@googlegroups.com (cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://go.googlecode.com/hg/

[dave_cheney.net, 2013-03-24 12:00:52]

Thank you for fixing this.

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody
File src/cmd/cc/lexbody (right):

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody#newcode266
src/cmd/cc/lexbody:266: if(strlen(s->name) == l-1 && memcmp(s->name, symb, l) ==
0)
is there a way to do this without ranging over the memory from s->name twice ?
WIll strncmp help ?

https://codereview.appspot.com/7876044/diff/4001/src/cmd/ld/lib.c
File src/cmd/ld/lib.c (right):

https://codereview.appspot.com/7876044/diff/4001/src/cmd/ld/lib.c#newcode859
src/cmd/ld/lib.c:859: if(strlen(s->name) == l-1 && memcmp(s->name, symb, l) ==
0)
same

[minux1, 2013-03-24 12:13:38]

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody
File src/cmd/cc/lexbody (right):

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody#newcode266
src/cmd/cc/lexbody:266: if(strlen(s->name) == l-1 && memcmp(s->name, symb, l) ==
0)
as symb is also nul-terminated C string, why not use
strncmp?
if(strncmp(s->name, symb, l-1) == 0 && s->name[l] == '\0')

[remyoudompheng, 2013-03-24 12:33:43]

Hello golang-dev@googlegroups.com, dave@cheney.net, minux.ma@gmail.com (cc:
golang-dev@googlegroups.com),

Please take another look.

[remyoudompheng, 2013-03-24 12:35:41]

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody
File src/cmd/cc/lexbody (right):

https://codereview.appspot.com/7876044/diff/4001/src/cmd/cc/lexbody#newcode266
src/cmd/cc/lexbody:266: if(strlen(s->name) == l-1 && memcmp(s->name, symb, l) ==
0)
On 2013/03/24 12:13:38, minux wrote:
> as symb is also nul-terminated C string, why not use
> strncmp?
> if(strncmp(s->name, symb, l-1) == 0 && s->name[l] == '\0')

A simple strcmp seems easier and it's not less safe.

[minux1, 2013-03-24 12:46:11]

LGTM.

[remyoudompheng, 2013-03-25 07:20:27]

*** Submitted as https://code.google.com/p/go/source/detail?r=d448734315d3 ***

cmd/cc, cmd/ld: do not overflow strings in symbol lookup.

R=golang-dev, dave, minux.ma
CC=golang-dev
https://codereview.appspot.com/7876044