3 ms·
It's a long-shot but I wonder if OpenBSD has specified that groups are only unique up to 8 characters. Like it certainly looks like a bug to my eyes too, but m
by smcl 3y ago
It's a long-shot but I wonder if OpenBSD has specified that groups are only unique up to 8 characters.
Like it certainly looks like a bug to my eyes too, but my default when I see something like this in OpenBSD code is "maybe I just don't get it".
- jraph 3y agoIf OpenBSD had specified that groups are only unique up to 8 characters, wouldn't they avoid to specify a "_shutdown" group of higher length? Looks like an overlook to me. Double click on operator, yank, type the new group name, done. Or even a quick replace all not noticing there was an hardcoded length right after one of the occurrences. The parent might have found an actual issue. But happy to join you in the "maybe I just don't get it" clan. You still need to be root to create groups and assign them to users, so probably not a big one and it will probably work all the time in practice. How funny is this, someone randomly asks for the diff on HN for no apparent reason, someone else gives a link, someone else randomly opens the link and finds a potential bug. Eyeballs, shallow bugs…
- smcl 3y agoLooking back at the change after lunch it does seem like it was a rename without realising the strings were a different length. Actually changing "operator" to "shutdown", confirming the length was the same and didn't need to change, then realising it needs to be prefixed with "_" but not updating the length param would explain this nicely.
- xxpor 3y agoIf that's the case, there should be a #define for that length. If not, they should be using strlen("_shutdown") or sizeof("_shutdown")+1 There's really no excuse for a magic number there.
- NikkiA 3y agoyou'd want strlen("_shutdown")+1, since checking without the null-terminator means that you match with strings like '_shutdown123'. It's one of the reasons why I detest the strcmp warning, as strcmp is perfectly safe given a literal string as a comparison, the comparison will drop out as not matching whenever the first NUL happens, and a literal string acts the same as specifying 'n'. Blind usage of strncmp leads to perhaps even more bugs than blind usage of strcmp.
- smcl 3y agoThat would introduce a bug. See the following: #include <stdio.h> int main() { printf("%lu\n", strlen("_shutdown")); printf("%lu\n", sizeof("_shutdown")); return 0; } This prints the numbers 9 and 10 (on gcc I have). So if you used `sizeof(...)+1` when calculating the length argument for strcmp you'd be comparing the 9-byte string, the null terminator and one character of random nonsense.