[PATCH] passt-repair: Ensure that read buffer is NULL-terminated

[PATCH] passt-repair: Ensure that read buffer is NULL-terminated

[Stefano Brivio]

After 3d41e4d83895 ("passt-repair: Correct off-by-one error verifying
name"), Coverity Scan isn't convinced anymore about the fact that the
ev->name used in the snprintf() is NULL-terminated.

It comes from a read() call, and read() of course doesn't terminate
it, but we already check that the byte at ev->len - 1 is a NULL
terminator, so this is actually a false positive.

In any case, the logic ensuring that ev->name is NULL-terminated isn't
necessarily obvious, and additionally checking that the last byte in
the buffer we read is a NULL terminator is harmless, so do that
explicitly, even if it's redundant.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 passt-repair.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/passt-repair.c b/passt-repair.c
index 440c77a..256a8c9 100644
--- a/passt-repair.c
+++ b/passt-repair.c
@@ -137,6 +137,7 @@ int main(int argc, char **argv)
 				fprintf(stderr, "inotify read: %i", errno);
 				_exit(1);
 			}
+			buf[n - 1] = '\0';
 
 			if (n < (ssize_t)sizeof(*ev)) {
 				fprintf(stderr, "Short inotify read: %zi", n);
-- 
@@ -137,6 +137,7 @@ int main(int argc, char **argv)
 				fprintf(stderr, "inotify read: %i", errno);
 				_exit(1);
 			}
+			buf[n - 1] = '\0';
 
 			if (n < (ssize_t)sizeof(*ev)) {
 				fprintf(stderr, "Short inotify read: %zi", n);
-- 
2.43.0

Re: [PATCH] passt-repair: Ensure that read buffer is NULL-terminated

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1642 bytes --]

On Thu, Apr 03, 2025 at 09:04:43PM +0200, Stefano Brivio wrote:
> After 3d41e4d83895 ("passt-repair: Correct off-by-one error verifying
> name"), Coverity Scan isn't convinced anymore about the fact that the
> ev->name used in the snprintf() is NULL-terminated.

Aww, man :(

> It comes from a read() call, and read() of course doesn't terminate
> it, but we already check that the byte at ev->len - 1 is a NULL
> terminator, so this is actually a false positive.

Indeed.  I'm kind of baffled that it's able to reason it out with the
off-by-one, but not without.

> In any case, the logic ensuring that ev->name is NULL-terminated isn't
> necessarily obvious, and additionally checking that the last byte in
> the buffer we read is a NULL terminator is harmless, so do that
> explicitly, even if it's redundant.
> 
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Vexing that it's necessary, but

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  passt-repair.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/passt-repair.c b/passt-repair.c
> index 440c77a..256a8c9 100644
> --- a/passt-repair.c
> +++ b/passt-repair.c
> @@ -137,6 +137,7 @@ int main(int argc, char **argv)
>  				fprintf(stderr, "inotify read: %i", errno);
>  				_exit(1);
>  			}
> +			buf[n - 1] = '\0';
>  
>  			if (n < (ssize_t)sizeof(*ev)) {
>  				fprintf(stderr, "Short inotify read: %zi", n);

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]