Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #15105

Re: Memory leaking in memmove

Show all headers | View raw

ArifulHossain tuhin <etothepowerpi@gmail.com> wrote:
> On Wednesday, December 28, 2011 4:36:37 PM UTC+6, Philip Lantz wrote:
> > Are you sure that packet->size + pad_len < sizeof packet->data.buf? That 
> > check should probably be in the code, unless there are constraints on 
> > the packet size that guarantee that it is always true.

> Packet size can be as high as 230 with pad_len.

You mean that 'packet->size + pad_len' is never larger than 230?
How can that be if, as you claim yourself below, 'pad_len' can be
as large as 255?

> unsigned char pad_len;
> pad_len = (unsigned char)((random() % RANSTOP ) + RANSTART);

> pad_len is unsigned char. so it should cover upto 256.

I guess you mean 255. And then don't cast but do

 pad_len = ( random( ) % RANSTOP + RANSTART ) & 0xFF;

Unsigned char must cover at least the range from 0 to 255 but it
can have a larger range (char does not necessarily just have 8
bits).

> if(pad_len%30 == 0)
> pad_len = 9;

This looks rather strange. Why reduce 'pad_len' to 9 only when
it's a multiple of 30?

> if(packet->size > 0){
>         memmove(packet->data.buf + pad_len, packet->data.buf, packet->size);

So what exactly are 'pad_len' and 'packet->size' when it segfaults?
If it really crashes at this point then they must be something
different from what you expect them to be.

>         packet->size += pad_len;
>         packet->data.buf[0] = pad_len;
>         for(j=1; j< pad_len; j++)
>         packet->data.buf[j] = (char)256%j;

Casting 256 to a char looks rather ridiculous. Typiclally chars
are in the range from 0 to 255 or -128 to 127. What are you at-
tempting to achieve with all this?

>         EnDeCrypt(packet->data.buf, packet->size, key, KEYLEN);
> }
> 
> the packet data structure is decalared as follows:
> 
> struct rtp_packet {
>     size_t      size;
>     ................
>     (some fields)
>     ................
>     struct rtp_packet *next;
>     struct rtp_packet *prev;
>     union {
>         rtp_hdr_t       header;
>         unsigned char   buf[8192];
>     } data;

> sizeof(packet->data.buf) is 8 so it should not be a problem. Though
> i guess should put a checking into the code anyway.

The size of the buffer 'buf' must be 8192. Where did you get that
8 from?
                              Regards, Jens
-- 
  \   Jens Thoms Toerring  ___      jt@toerring.de
   \__________________________      http://toerring.de

Back to comp.lang.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 01:24 -0800
  Re: Memory leaking in memmove Nick Keighley <nick_keighley_nospam@hotmail.com> - 2011-12-28 02:20 -0800
    Re: Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 02:37 -0800
      Re: Memory leaking in memmove Philip Lantz <prl@canterey.us> - 2011-12-28 02:42 -0800
      Re: Memory leaking in memmove Nick Keighley <nick_keighley_nospam@hotmail.com> - 2011-12-28 03:36 -0800
        Re: Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 03:50 -0800
      Re: Memory leaking in memmove Seebs <usenet-nospam@seebs.net> - 2011-12-28 18:17 +0000
  Re: Memory leaking in memmove Philip Lantz <prl@canterey.us> - 2011-12-28 02:36 -0800
    Re: Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 03:57 -0800
      Re: Memory leaking in memmove Dr Nick <3-nospam@temporary-address.org.uk> - 2011-12-28 12:21 +0000
        Re: Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 04:26 -0800
      Re: Memory leaking in memmove jt@toerring.de (Jens Thoms Toerring) - 2011-12-28 12:46 +0000
  Re: Memory leaking in memmove ArifulHossain tuhin <etothepowerpi@gmail.com> - 2011-12-28 05:54 -0800
  Re: Memory leaking in memmove Ben Bacarisse <ben.usenet@bsb.me.uk> - 2011-12-28 14:46 +0000
    Re: Memory leaking in memmove Philip Lantz <prl@canterey.us> - 2011-12-28 12:20 -0800
      Re: Memory leaking in memmove Ben Bacarisse <ben.usenet@bsb.me.uk> - 2011-12-28 21:50 +0000
  Re: Memory leaking in memmove Barry Schwarz <schwarzb@dqel.com> - 2011-12-28 10:36 -0800

csiph-web