Re: Fix traversing array in libc mktemp_internal()

2010-02-08 Thread Philip Guenther
2010/2/8 Vadim Zhukov : > Looks like I was just lucky. :) I do not use malloc.conf. And mktemp(1) > failed for me only sometimes (I'm using it for generating > passwords: "mktemp XX"). After a few crashes I realized that it > hurts me too much... Do not remember what snapshot it was, though

Re: Fix traversing array in libc mktemp_internal()

2010-02-08 Thread Vadim Zhukov
On 8 February 2010 c. 23:50:53 Philip Guenther wrote: > 2010/2/8 Vadim Zhukov : > > Thank you for your attention. And sorry, but I think that your > > version is wrong: in case of only one "X" you'll have "tries" set to > > 1 instead of NUM_CHARS. > > > > Time to write some regress tests for mktem

Re: Fix traversing array in libc mktemp_internal()

2010-02-08 Thread Philip Guenther
2010/2/8 Vadim Zhukov : > Thank you for your attention. And sorry, but I think that your version is > wrong: in case of only one "X" you'll have "tries" set to 1 instead of > NUM_CHARS. Time to write some regress tests for mktemp obviously. Do you happen to have a program reliably demonstrates

Re: Fix traversing array in libc mktemp_internal()

2010-02-08 Thread Vadim Zhukov
On 8 February 2010 c. 21:00:53 Philip Guenther wrote: > 2010/1/27 Vadim Zhukov : > > Current implementation of mktemp_internal() access memory before the > > string given when the whole template given consists of 'X' > > characters. > > Nice catch! I've committed a slightly different fix, but the

Re: Fix traversing array in libc mktemp_internal()

2010-02-08 Thread Philip Guenther
2010/1/27 Vadim Zhukov : > Current implementation of mktemp_internal() access memory before the > string given when the whole template given consists of 'X' characters. Nice catch! I've committed a slightly different fix, but the base idea is the same, thanks! Philip Guenther

Fix traversing array in libc mktemp_internal()

2010-01-27 Thread Vadim Zhukov
Hello all. Current implementation of mktemp_internal() access memory before the string given when the whole template given consists of 'X' characters. First hunk of patch also removes extra check: "strlen() == 0" is done anyway for non-error flow, so "*path == '\0'" does not give any actual sp