|
Description
|
usr/src/cmd/vscan/vscand/vs_icap.c
1227: hlen = snprintf(head, sizeof (head), "%x\r\n", nread);
1228: hdr += (VS_HDR_SZ - hlen);
1229: (void) memcpy(hdr, head, hlen);
1230: tail = hdr + (hlen + nread);
1231: tail[0] = '\r';
1232: tail[1] = '\n';
hdr is a pointer into vsi_send_hdr in the structure:
typedef struct vs_info {
char vsi_send_hdr[VS_HDR_SZ];
char vsi_send_buf[VS_BUF_SZ + VS_TAIL_SZ];
char vsi_recv_buf[VS_BUF_SZ];
...
} vs_info_t;
The pointer "tail" (calculated from "hdr") ends up pointing into the following array. This may be intentional, although the correct offset into the following array could be calculated directly.
This bug was found using the Parfait source code analysis tool.
See http://research.sun.com/projects/parfait
|
|
Comments
|
Yes, it is intentional that the tail points into the next array.
The message is made up of header, data and tail. These are split into two arrays:
vsi_send_hdr and vsi_send_buf where the header is in the former and the data and
tail are in the latter.
The code could be better written such that the tail pointer is calculated relative to
the start of the vsi_send_buf array.
|
