Buffer with garbage could cause problems

Issue #27 resolved
Teemu Halmela created an issue

If the toolkit is given a non empty buffer the output will include content of this buffer.

This can be fixed by not taking the output length with strlen and just going with our counter. FIX and test

Note: My silly test overflows the buffer when the fix isn't applied. Maybe there should be a check for that overflow?

$ ./test0100_outjson_garbage_buffer32                                 
input(97):            
{"pgm":[{"name":"HELLO","lib":"DB2JSON"},{"s":{"name":"char","type":"128a","value":"Hi there"}}]}
output(587):          
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXÞ­"script":[{"pgm":["HELLO","DB2JSON",{"char":"Hello World"}]}]}

result:               
fail found(X)         
fail (-1)             
Segmentation fault (core dumped)

Comments (4)

  1. Former user Account Deleted

    Ok, i removed strlen from json_output_printf.

    YIPS Super Driver - test driver - 1.1.4-sg7 toolkit - Buffer with garbage could cause problems (Halmela)

    warning (i can't recall ...)

    Mm ... json_output_printf seems to work with tests. I have no idea why originally added. I commented out in source for now.

    Thanks (i think).

    int json_output_printf(...) {
      int retLen = outLen;
      char *p = (char *) NULL; 
      char *q = (char *) NULL; 
      int l = 0;
      int w = 0;
      int printLen = 0;
      va_list args;
      /* Halmela asserts remove strlen will work.
      if(retLen == 0){
        retLen = strlen(out_caller);
      }
      */
    
  2. Teemu Halmela reporter

    It was there originally because the buffer length wasn't stored and the length was calculated every time. But now it is completely useless as we get the length from outside.

  3. Log in to comment