ID: 40600
Updated by: iliaa@php.net
Reported By: stas at FreeBSD dot org
-Status: Assigned
+Status: Bogus
Bug Type: POSIX related
Operating System: FreeBSD
PHP Version: 5.2.1
Assigned To: iliaa
New Comment:
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php
The current code is fine, we should not hardcode buffer sizes
if they cannot be retrieved, this could lead to exploitable
situations. Also if the return buffer length of 0 it probably
indicates a problem.
Previous Comments:
------------------------------------------------------------------------
[2007-02-23 14:07:38] tony2001@php.net
Ilia, please take a look at this, IIRC you added those sysconf()
patches.
------------------------------------------------------------------------
[2007-02-23 13:55:02] tony2001@php.net
>Yeah... According to susv3:
Yes, I know that, thanks.
But that does not mean "if (buflen < 1)" is incorrect.
I don't think that zero buflen is a correct value (and even if it is,
it's useless).
------------------------------------------------------------------------
[2007-02-23 13:47:59] stas at FreeBSD dot org
>>This patch covers two problems:
>>1) The POSIX says that sysconf will return -1 on failure,
>> thus the ( < check is definitely incorrect
>
>Oh? Care to elaborate?
Yeah... According to susv3:
"If name is an invalid value, sysconf() shall return -1 and set errno
to indicate the error. If the variable corresponding to name has no
limit, sysconf() shall return -1 without changing the value of errno.
Note that indefinite limits do not imply infinite limits; see
<limits.h>."
>>2) It's safe to use the buffer of any size (according to
>> POSIX), since you give the buffer length to these
>> functions.
>
>Yeah, according to POSIX those functions must be >implemented.
>But they are not.
>it's better then give up on retriving this info just in
>case the sysconf doesn't has these limit values.
>I don't think it's any better to use hacks to workaround >missing
FreeBSD
> functionality.
Ok, agree. It's open to you.
------------------------------------------------------------------------
[2007-02-23 12:22:20] tony2001@php.net
>This patch covers two problems:
>1) The POSIX says that sysconf will return -1 on failure,
> thus the ( < check is definitely incorrect
Oh? Care to elaborate?
>2) It's safe to use the buffer of any size (according to
> POSIX), since you give the buffer length to these
> functions.
Yeah, according to POSIX those functions must be implemented.
But they are not.
>it's better then give up on retriving this info just in
>case the sysconf doesn't has these limit values.
I don't think it's any better to use hacks to workaround missing
FreeBSD functionality.
------------------------------------------------------------------------
[2007-02-23 10:47:13] stas at FreeBSD dot org
- if (buflen < 1) {
- RETURN_FALSE;
- }
+ if (buflen < 0)
+ buflen = 1024;
>It might be safe to do it on FreeBSD when you know for sure >that this
functionality is missing and it's safe to use 1K >buffer, but other
systems might behave differently.
This patch covers two problems:
1) The POSIX says that sysconf will return -1 on failure, thus the ( <
1) check is definitely incorrect
2) It's safe to use the buffer of any size (according to POSIX), since
you give the buffer length to these functions. They'll return error if
the buffer lenght isn't enough - it's better then give up on retriving
this info just in case the sysconf doesn't has these limit values.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/40600
--
Edit this bug report at http://bugs.php.net/?id=40600&edit=1