4 ms·
To me, PORT_Memcpy is one problem here. There are two buffers and one size -- the amount of memory to copy. There should be PORT_Memcpy2(pDest, destSize, pSou
by jmull 5y ago
To me, PORT_Memcpy is one problem here.
There are two buffers and one size -- the amount of memory to copy.
There should be PORT_Memcpy2(pDest, destSize, pSource, numBytesToCopy) (or whatever you want to call it) which at least prompts the programmer to account for the size destination buffer.
Then flag all calls to PORT_Memcpy and at least make a dev look at it.
(Same for the various similar functions like strcpy, etc.)
- twodayslate 5y agoOf course it would just end up being PORT_Memcpy2(cx->u.buffer, sigLen, sig->data, sigLen);
- jmull 5y agoSomeone could do that, but the point of having the dest buffer size is to at least give the programmer a chance to try to get it right. I also wonder if a linter could notice that the dest buffer size passed isn’t the actual size of the buffer. (That leads the the next problem in the code, if you look at the definition of that buffer, so that’s good.)
- ndesaulniers 5y agonumBytesToCpy != sourceSize Otherwise that's a potential read out of bounds.