From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner+willy=40w.ods.org-S261247AbVFCMrJ@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S261247AbVFCMrJ (ORCPT <rfc822;willy@w.ods.org>);
	Fri, 3 Jun 2005 08:47:09 -0400
Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261249AbVFCMrJ
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Fri, 3 Jun 2005 08:47:09 -0400
Received: from mx1.suse.de ([195.135.220.2]:7109 "EHLO mx1.suse.de")
	by vger.kernel.org with ESMTP id S261247AbVFCMrC (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 3 Jun 2005 08:47:02 -0400
Date: Fri, 03 Jun 2005 14:47:00 +0200
Message-ID: <s5hfyvzr4jf.wl@alsa2.suse.de>
From: Takashi Iwai <tiwai@suse.de>
To: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Willy Tarreau <willy@w.ods.org>, XIAO Gang <xiao@unice.fr>,
       Linux Kernel Development <linux-kernel@vger.kernel.org>
Subject: Re: Suggestion on "int len" sanity
In-Reply-To: <Pine.LNX.4.62.0506031142050.16362@numbat.sonytel.be>
References: <429D5E79.2010707@unice.fr>
	<20050601203933.GP18600@alpha.home.local>
	<Pine.LNX.4.62.0506031142050.16362@numbat.sonytel.be>
User-Agent: Wanderlust/2.10.1 (Watching The Wheels) SEMI/1.14.5 (Awara-Onsen) FLIM/1.14.5 (Demachiyanagi) APEL/10.6 MULE XEmacs/21.4 (patch 15) (Security Through Obscurity) (i386-suse-linux)
MIME-Version: 1.0 (generated by SEMI 1.14.5 - "Awara-Onsen")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
X-Mailing-List: linux-kernel@vger.kernel.org

At Fri, 3 Jun 2005 11:42:23 +0200 (CEST),
Geert Uytterhoeven wrote:
> 
> On Wed, 1 Jun 2005, Willy Tarreau wrote:
> > On Wed, Jun 01, 2005 at 09:06:33AM +0200, XIAO Gang wrote:
> > > I would like to make a security suggestion.
> > > 
> > > There are many length variables in the kernel, locally declared as "len" 
> > > or "length", either as "int", "unsigned int" or "size_t". However, 
> > > declaring a length as "int" leads easily to an erroneous situation, as 
> > > the author (or even a code checker) might make the implicite hypothesis 
> > > that the length is positive, so that it is enough to make a sanity check 
> > > of the kind
> > > 
> > > if (length > limit) ERROR;
> > > 
> > > which is not enough.
> > > 
> > > On the other hand, when a variable is named "len" or "length", it is 
> > > usually used for length and never should go negative. So could I suggest 
> > > that the declarations of these variables to be uniformized to "size_t", 
> > > via a gradual but sysmatic cleanup?
> > 
> > Probably true for most cases, but be careful of code which would use
> > -1 to report some errors if such thing exists.
> 
> In that case, use ssize_t.

In some cases, we may want to avoid [s]size_t because it varies on 32
and 64bit archs (e.g. ioctl parameters)...


Takashi