[#7708] Bug in libsnmp-ruby1.8 — Hadmut Danisch <hadmut@...>

Hi,

8 messages 2006/04/11
[#7709] Re: Bug in libsnmp-ruby1.8 — Eric Hodel <drbrain@...7.net> 2006/04/11

On Apr 11, 2006, at 6:23 AM, Hadmut Danisch wrote:

[#7770] Re: possible defect in array.c — "Brown, Warren" <warrenbrown@...>

> rb_range_beg_len (in range.c) does set beg and len.

13 messages 2006/04/26
[#7771] Re: possible defect in array.c — "Pat Eyler" <rubypate@...> 2006/04/26

On 4/26/06, Brown, Warren <warrenbrown@aquire.com> wrote:

Re: possible defect in ext/openssl/ossl_ans1.c (with fix)

From: "Jacob Fugal" <lukfugl@...>
Date: 2006-04-27 05:19:22 UTC
List: ruby-core #7789
On 4/26/06, ville.mattila@stonesoft.com <ville.mattila@stonesoft.com> wrote:
>
> I think this is false positive.

<snip>

>770                  if(!rb_obj_is_kind_of(value, rb_cArray)){

<snip>

> >778                    case V_ASN1_BIT_STRING:
> >779                        value = decode_bstr(start, hlen+len, &flag);
>       Here the flag is initialized

<snip>

> >800                  if(tag == V_ASN1_BIT_STRING){
>       and here we have same tag as in line 779.

But lines 778 and 779 are never executed if the condition in line 770
is false (ie. rb_obj_is_kind_of(value, rb_cArray) returns true). It's
possible that tag equalling V_ASN1_BIT_STRING and value being kind_of
rb_cArray are mutually exclusive. If so, the code is safe, but not
explicit. I would fix it by amending the conditional in line 800:

--- ext/openssl/ossl_asn1.c
+++ ext/openssl/ossl_asn1.c
@@ -797,7 +797,7 ****
               }
           }
           asn1data = rb_funcall(klass, rb_intern("new"), 1, value);
-          if(tag == V_ASN1_BIT_STRING){
+          if(!rb_obj_is_kind_of(value, rb_cArray) && tag == V_ASN1_BIT_STRING){
               rb_iv_set(asn1data, "@unused_bits", LONG2NUM(flag));
           }
       }

Jacob Fugal


In This Thread

Prev Next