On Fri, 8 Aug 2003, David Byron wrote:

> Something else that Dan Fandrich mentioned that I didn't implement was
> length checking. This may open a bigger can of worms, but Curl_file_connect
> dereferences conn and conn->path without checking for NULL.

They won't be NULL. Having them NULL would be major and then it should bail
out long before this function is called.

> Do you have some global policy for checking for NULL? Something that uses
> assert or some custom defined ASSERT()?

I don't have a global policy for this, no. But there are a bunch of pointers
that are checked when the memory is allocated and then they are never checked
again, even when functions are called.

> In any case, here's a patch to add a strlen() check before dereferencing
> actual_path[2] (diff against file.c.1.32). Had the urge to add some
> parentheses which I should have added before. Hope that's OK.

I have no problems with parentheses, but I replaced the strlen() with a check
for actual_path[1] instead.

> A few ways to test this come to mind. All of them require a bit more code
> -- either more messages, and teaching the test harness to look at them, or
> some external memory test tool.

Actually testing the X: code would require a win32-specific test case to be
added. I wouldn't mind that though.

-- 
 Daniel Stenberg -- curl: been grokking URLs since 1998
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01