[netcf-devel] [PATCH 1/5] Windows port of netcf api calls

Laine Stump laine at laine.org
Thu Sep 23 14:36:32 UTC 2010


  On 09/23/2010 08:18 AM, Daniel P. Berrange wrote:
> On Thu, Sep 23, 2010 at 08:06:42AM -0400, Laine Stump wrote:
>>>> +			sprintf(ipBuf,"%d",inet_ntoa(ipAddr));
>>> Where is the guarantee that ipBuf is big enough for this sprintf, or is
>>> there a possibility of buffer overflow?
>>
>> Beyond that, I'm confused about what this sprintf thinks it's printing -
>> it looks to me like it's printing out the decimal conversion of the
>> *address* of a char* that contains an ASCII representation of an IP
>> address. ???
>>
>> BTW, note that inet_ntoa is not threadsafe (the same static buffer is
>> reused by all callers in all threads of the process), so it shouldn't be
>> used. Better to use inet_ntop instead.
>>
>>>> +		     "%d.%d.%d.%d", (ip>>    0)&    255, (ip>>    8)&    255,
>>>> +		     (ip>>    16)&    255, (ip>>    24)&    255);
>>> Maybe it's just me, but I prefer 0xff rather than 255 when masking bits.
>>>     If we could guarantee that gnulib gives us %hhd support, you could
>>> avoid the mask (and just do the shift).
>>
>> Why not use inet_ntop() instead?
>
> None of the inet_XXXX() APIs should ever be used in modern code.
> The getaddrinfo + getnameinfo functions suffice for all use cases
> previously handled by inet_XXXX()

Yes, correct - that's the one I should have recommended. I started out 
thinking "there's a newer function for this", which transformed into "I 
remember getaddrinfo" --> "ah, but getaddrinfo does the opposite of what 
I want", and then I got to inet_netop(), it looked safe enough, so I 
didn't go any further.

A make syntax-check that complained about these, and recommended the 
proper newer function would be nice to have...




More information about the netcf-devel mailing list