Hi,
On Tue Oct 25, 2022 at 5:03 PM CEST, spaceman wrote:
> Hi,
>
> While compiling dwm on slackware 15 I get the following (with _FORTIFY_SOURCE=3):
And therein lies the catch. The call to strncpy(3) copies the symbol of the
currently selected layout to the layout symbol (ltsymbol) which will later be
printed to the bar. The maximum length of this symbol is 16 chars and normally
this isn't an issue since those symbols do not consist of large strings.
But in case someone decides to create a longer symbol text, this would overflow.
Given that we compile with -Wall, the compiler would probably emit a warning
and the user should notice his mistake. However, a length check & truncation
of the last char doesn't seem harmful at all. Thoughts?
> In file included from /usr/include/string.h:519,
> from dwm.c:29:
> In function 'strncpy',
> inlined from 'arrangemon' at dwm.c:400:2,
> inlined from 'arrange' at dwm.c:394:3,
> inlined from 'arrange' at dwm.c:384:1:
> /usr/include/bits/string_fortified.h:95:10: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
> 95 | return __builtin___strncpy_chk (__dest, __src, __len,
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 96 | __glibc_objsize (__dest));
> | ~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'strncpy',
> inlined from 'arrangemon' at dwm.c:400:2,
> inlined from 'arrange' at dwm.c:391:3:
> /usr/include/bits/string_fortified.h:95:10: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
> 95 | return __builtin___strncpy_chk (__dest, __src, __len,
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 96 | __glibc_objsize (__dest));
> | ~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'strncpy',
> inlined from 'setlayout' at dwm.c:1508:2:
> /usr/include/bits/string_fortified.h:95:10: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
> 95 | return __builtin___strncpy_chk (__dest, __src, __len,
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 96 | __glibc_objsize (__dest));
>
> This was enough to stop me updating from 6.3.
>
The last time I could find a modified strncpy in the logs in one of those
places is somewhere around 2009. This isn't something introduced lately and
should also occur when building older versions of dwm.
--
Best Regards,
Tom Schwindl
Received on Wed Oct 26 2022 - 16:10:19 CEST