Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-z.one.com (mx-z.one.com [195.47.247.151])
	by mail6.local (Postfix) with ESMTP id E06D68014FAE2
	for <filtered@awaresystems.be>; Fri, 20 Sep 2013 19:26:57 +0200 (CEST)
X-Virus-Scanned: by one.com
Received-SPF: pass (mx-z: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.215.42 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-la0-f42.google.com (mail-la0-f42.google.com [209.85.215.42])
	by mx-z.one.com (Postfix) with ESMTP id A1B102381EE4B
	for <filtered@awaresystems.be>; Fri, 20 Sep 2013 17:26:57 +0000 (UTC)
Received: by mail-la0-f42.google.com with SMTP id ep20so593299lab.1
        for <filtered@awaresystems.be>; Fri, 20 Sep 2013 10:26:57 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=delivered-to:domainkey-status:delivered-to:message-id:date:from
         :user-agent:mime-version:to:references:in-reply-to:cc:subject
         :precedence:list-id:list-unsubscribe:list-archive:list-post
         :list-help:list-subscribe:content-type:content-transfer-encoding
         :sender:errors-to;
        bh=6r4NaZeqr3wQVkjsfSoEx0xd7j+m584ovXJt9LeJTiI=;
        b=cD1VbLBCRXM2LEiSjj6Tbwq8W0X5eaiASdqlPiSmq3cZlF66YlH6sTf7O1mRqoCBu+
         PZMNc72GJMEYpk4vnjGHYTqwgrbFF2q7TSGoE7vKP/32OZ7kDS4PRAky1PEB5sIueoju
         OHi3lpvTlrJWf/ItFKJuuZKvj5Ds/VLXLzGi7rJtBUp6Z/1lCHqNn0IA+JPNcLA3mKM7
         qxa4RXDDWGoi8s9PHAmU4kL8wokxoORZIrtjheKoOpAHSeKgW2tJhkKeYdM8C4vyLoGS
         Dd3NbEY2Js37+G7I1hZ0ws3OjIMp+gBp3YP4PU2XjVwA4EtSSuQxTkIoUpwo+OqXNRfK
         l++g==
X-Received: by 10.152.22.198 with SMTP id g6mr6905360laf.5.1379698017288;
        Fri, 20 Sep 2013 10:26:57 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.114.2.237 with SMTP id 13csp25299ldx;
        Fri, 20 Sep 2013 10:26:56 -0700 (PDT)
X-Received: by 10.152.30.74 with SMTP id q10mr7013842lah.27.1379698016223;
        Fri, 20 Sep 2013 10:26:56 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: neutral (google.com: 195.47.247.149 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=195.47.247.149;
Received: by 10.152.99.180 with POP3 id er20mf298444lab.12;
        Fri, 20 Sep 2013 10:26:56 -0700 (PDT)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-x.one.com (mx-x.one.com [195.47.247.149])
	by mail6.local (Postfix) with ESMTP id 4B36A8014FAE2
	for <info@awaresystems.be>; Fri, 20 Sep 2013 19:23:38 +0200 (CEST)
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by mx-x.one.com (Postfix) with ESMTP id 5EA3E2A41
	for <info@awaresystems.be>; Fri, 20 Sep 2013 17:23:36 +0000 (UTC)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id F410735C033;
	Fri, 20 Sep 2013 12:22:57 -0500 (EST)
Received: from mail.howardsilvan.com (fangorn.howardsilvan.com
	[216.235.106.115])
	by lists.maptools.org (Postfix) with ESMTPS id 340BC35C033
	for <tiff@lists.maptools.org>; Fri, 20 Sep 2013 12:22:08 -0500 (EST)
Received: from fangorn.howardsilvan.com (localhost [127.0.0.1])
	by mail.howardsilvan.com (Postfix) with ESMTPA id 9B456C42166;
	Fri, 20 Sep 2013 10:22:04 -0700 (PDT)
Received: from bilbo.x101.com ([64.146.212.27] helo=bilbo.x101.com) with
	IPv4:225 by fangorn.howardsilvan.com; 20 Sep 2013 10:22:04 -0700
Message-ID: <523C8434.1050105@howardsilvan.com>
Date: Fri, 20 Sep 2013 10:21:56 -0700
From: Lee Howard <faxguy@howardsilvan.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:17.0) Gecko/20130110 Thunderbird/17.0.2
MIME-Version: 1.0
To: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
References: <CAEDdjHdjO-Y+bf57V0AWVSu6xoeSH7aeY4-f4C7dsujgTPPoww@mail.gmail.com>
	<CAEDdjHdLCRxZC6JrAK_8m0PXqBV_HgQoqFu7mkGEZVt5Q1w=3A@mail.gmail.com>
	<523C7322.4040803@howardsilvan.com>
	<alpine.GSO.2.01.1309201122320.3391@freddy.simplesystems.org>
	<523C78FD.9060608@howardsilvan.com>
	<alpine.GSO.2.01.1309201157520.3391@freddy.simplesystems.org>
In-Reply-To: <alpine.GSO.2.01.1309201157520.3391@freddy.simplesystems.org>
Cc: Pedro Ribeiro <pedrib@gmail.com>,
	"tiff@lists.maptools.org" <tiff@lists.maptools.org>
Subject: Re: [Tiff] Vulnerabilities in libtiff 4.0.3
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On 09/20/2013 10:02 AM, Bob Friesenhahn wrote:
> On Fri, 20 Sep 2013, Lee Howard wrote:
>>
>> The snprintf man page says:
>>
>>       The functions snprintf() and vsnprintf() write at most size 
>> bytes (including the trailing null byte ('\0')) to str.
>>
>>       The trailing null byte is added to str, unless size is zero.
>>
>> Is it wrong?  What am I missing?
>
> snprintf always writes the number of bytes specified by size.  If the 
> string is smaller than size, then the remaining space is filled with 
> zero bytes.  If the string is exactly size, then no null termination 
> is added at all.  For this reason, it is always necessary to follow up 
> an snprintf with a write of zero to the last byte in the array to 
> assure that it is a valid null-terminated C string.  There are some 
> cases (e.g. specific file formats) where the buffer is not required to 
> be null-terminated since the reader is required to read only up to N 
> bytes.


There are several cases where snprintf is used with string input in the 
tools...

$ grep snprintf * | grep %s
rgb2ycbcr.c:      snprintf(buf, sizeof(buf), "YCbCr conversion of %s",
tiff2bw.c:    snprintf(thing, sizeof(thing), "B&W version of %s", 
argv[optind]);
tiffcrop.c:      snprintf(filenum, sizeof(filenum), "-%03d%s", findex, 
export_ext);
tiffcrop.c:          snprintf(temp_filename, sizeof(temp_filename), 
"%s-read-%03d.%s",
tiffcrop.c:          snprintf(temp_filename, sizeof(temp_filename), 
"%s-write-%03d.%s",
tiffdither.c:    snprintf(thing, sizeof(thing), "Dithered B&W version of 
%s", argv[optind]);
tiffgt.c:        snprintf(title, TITLE_LENGTH - 1, "%s [%u]", 
filelist[fileindex],
tiffgt.c:        snprintf(title, 1024, "%s [%u] %d%%", filelist[fileindex],

Only in one instance in tiffcrop.c does the code ensure null-termination.

Is this something that you want to address, yourself?

Thanks,

Lee.

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
