Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c++ > #7318

Re: reading from a temp file

Show key headers only | View raw

Jens Thoms Toerring <jt@toerring.de> wrote:
> Ruben Safir <ruben@mrbrklyn.com> wrote:
>> On Tue, 28 Jun 2011 09:55:53 +0000, Jens Thoms Toerring wrote:
> 
>> > Also note that if the 'EDITOR' environment variable should be set you're
>> > now trying to write into memory belonging to what- ever returned the
>> > environment string. Definitely not a good idea - while getenv()
>> > unfortunately returns a 'char *' and not a 'char const *' (which would
>> > make this mistake impossible) it's not meant as allowing you to modify
>> > that string (or, worse, write past its trailing '\0').
> 
>> what are you say?  That I can overwrite the environmental variable?
> 
>>>>      editor = getenv("EDITOR");
>>>>      if (editor == NULL){
>>>>         editor  = default_editor;
>>>>      }
>>>>      strcat(editor, path);
> 


Yeah - that is a definite bug.  I must have had a brain crap.  I
obviously can strcat onto a string which doesn't have any extra buffer
allocation, let alone do so without checking the size of the string to
assure safety...

> With that code you append to the string you got from
> getenv() unless it did return NULL, i.e. in the case
> that the 'EDITOR' environment variable is set. And
> that's not such a good thing to try - you're not even
> supposed to change that string. To be (more or less)
> on the safe side you would need
> 
>      editor = getenv( "EDITOR" );
>      if ( editor != NULL )
>      {
>          strcpy( default_editor, editor );
>          strcat( default_editor, " " ); // needed between command and path
>      }
>      editor = default_editor;
>      strcat( editor, path );
> 
> More or less safe because, of course, the 'default_editor'
> buffer needs to be large enough and there aren't any tests
> for that here (and you have no idea what the 'EDITOR' envi-
> ronment variable had been set to). So it probably would be
> more prudent to use std::string since then the size gets
> adapted automatically to whatever is needed, e.g. something
> like
> 
>    std::string editor( "vi " );
>    if ( ( char *env = getenv( "EDITOR" ) ) != 0 )
>                editor = std::string( env ) + " ";
>    editor += path;
>    ...
>    system( editor.c_str( ) );          
> 
>                           Regards, Jens

Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

reading from a temp file Ruben Safir <ruben@mrbrklyn.com> - 2011-06-28 08:34 +0000
  Re: reading from a temp file Ian Collins <ian-news@hotmail.com> - 2011-06-28 20:37 +1200
    Re: reading from a temp file jt@toerring.de (Jens Thoms Toerring) - 2011-06-28 09:55 +0000
      Re: reading from a temp file Ruben Safir <ruben@mrbrklyn.com> - 2011-06-28 12:32 +0000
        Re: reading from a temp file jt@toerring.de (Jens Thoms Toerring) - 2011-06-28 13:54 +0000
          Re: reading from a temp file Ruben Safir <mrbrklyn@panix.com> - 2011-07-01 05:14 +0000
        Re: reading from a temp file Michael DOUBEZ <michael.doubez@free.fr> - 2011-07-01 00:54 -0700
    Re: reading from a temp file Michael DOUBEZ <michael.doubez@free.fr> - 2011-07-01 01:20 -0700
      Re: reading from a temp file Ruben Safir <mrbrklyn@panix.com> - 2011-07-02 00:47 +0000

csiph-web