Trend Micro: Open source is more secure

TalkBack 45 of 62:

Next »

« Previous

• Thread View
• Flat View

There's a problem with your version...

regarding sizeof in the malloc call:

char* myFunction(char *path, char *fname)
{
char* filename = (char*) malloc(sizeof(char*)*MAX_PATH); //problem here

strcpy(filename, path);
strcpy(filename, "\\"); //corrected
strcpy(filename, fname);

return filename;
}

The problem here is that your're using sizeof to get the number of bytes it takes to hold a char pointer(memory address), not a char. Since a char and a char* take up a different amount of space, you will most likely get the wrong amount of bytes needed with malloc, potentially over-stepping the memory obtained. And if you replace the last two strcpy calls with strcat, you get the desired results.

You may be right about his code being "dead code", but if I'm going to have dead code, it should at least be safe so I won't have to risk the compiler not catching it.

Anyways, thanks for the discussion. Hope we could do this again sometime. Cheers!

Posted by: Tony Agudo   Posted on: 06/14/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now