On Thu, Sep 05, 2013 at 02:05:56AM +0200, manu@... wrote:
[..]
> Index: milter-greylist.c
> ===================================================================
> RCS file: /cvsroot/milter-greylist/milter-greylist.c,v
> retrieving revision 1.269
> retrieving revision 1.270
> diff -U 4 -r1.269 -r1.270
> --- milter-greylist.c 1 Sep 2013 04:59:42 -0000 1.269
> +++ milter-greylist.c 4 Sep 2013 23:58:30 -0000 1.270
> @@ -3800,14 +3800,16 @@
> }
>
> src = priv->priv_sr.sr_msg_x;
> for (i = 0; i < lcount; i++) {
> - if ((lbufs[i] = strndup(src, MAXREPLYLEN)) == NULL) {
> + if ((lbufs[i] = malloc(MAXREPLYLEN + 1)) == NULL) {
> mg_log(LOG_ERR, "strndup failed: %s",
> strerror(errno));
> exit(EX_OSERR);
> }
>
> + (void)strncpy(lbufs[i], src, MAXREPLYLEN);
> +
> src += MAXREPLYLEN;
> }
>
> lbufs[i] = NULL;
These changes seem to be not equivalent.
strndup() has other properties:
* the patch code always creates in lbuf[i] a MAXREPLYLEN + 1 sized buffer - strndup()
doesn't if the length of src is less than MAXREPLYLEN.
if (strlen(src) <= MAXREPLYLEN) {
lbufs[i] = strdup(src);
}
else {
if ((lbufs[i] = malloc(MAXREPLYLEN + 1)) == NULL) {
[..]
* strndup() always null-terminates the destination. strncpy doesn't if
length of src is greater or equal MAXREPLYLEN.
Above after strncpy()
lbufs[i][MAXREPLYLEN] = 0;
is missing.
malloc() does not guarantee that the allocate memory is zeroed.
Johann