Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NFD_MAX_STRLEN is 256, but MAX_PATH on Linux often is 4096, as well as unsafe strdup() use #103

Open
ell1e opened this issue Oct 4, 2021 · 1 comment

Comments

@ell1e
Copy link

ell1e commented Oct 4, 2021

I've checked the source code and found that NFD_MAX_STRLEN is 256 and maybe used for paths. However, on Linux MAX_PATH is often 4096. But with a 4096 buffer, it is probably risky to just put it multiple times onto the stack as done here since that might exceed the stack space on some systems with less stack by default (Alpine with musl-libc comes to mind). So that might need some more fundamental refactoring.

While checking this file, I have also found strdup() is used without null pointer checking, meaning the code would crash on allocation failure rather than allowing the calling application to recover in some way which would be preferable. I've seen a similar potential issue with NFDi_Malloc use. (I know this recovery isn't safely possible with glib/GTK+, but it should be with most/all(?) other targets.)

@ell1e
Copy link
Author

ell1e commented Oct 4, 2021

Side note: maybe strdup should also be replaced with an NFDi_strdup() that uses NFDi_Malloc and memcpy? Since that would otherwise not go through the custom allocator as probably intended. Just another thought that came to mind.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant