Another follow-up.
Wietse
--ELM1789594056-20786-0_
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Below is the post that I replied to. It was ostensibly sent to
postfix-users, but rejected as a non-member submission.
My concerns with this code:
- The __counted_by() length does not include the null terminator
(example: the ARGV_FAKE_BEGIN() macro). Postfix requires that
the null terminator is a valid array element.
- The patch updates ARGV.len before the ARGV.argv array itself.
This is an anti-pattern: Postfix normally assigns or increments
an array length after assigning the array (but I failed to do
that in argv_alloc()).
- Updating the length before the array contradicts Clang documentation:
https://clang.llvm.org/docs/BoundsSafetyImplPlans.html#paired-assignment-check
- Some text even appears to claim that "updating the capacity/count
field before allocating or updating the pointer can trigger a
compiler error or a runtime sanitizer trap" but that could be an
AI hallucination.
Wietse
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
