Re: libc6 bug? or C programming error?

[Steve Greenland <steveg@moregruel.net>]

On 02-Dec-03, 18:37 (CST), Oliver Elphick <olly@lfix.co.uk> wrote: 
> /********************************************************************
>  Write a line in user_clusters 
>  ********************************************************************/
> void write_cluster_line(const char *user, const char *group,
>                         const char *cluster, const char *db,
>                         const int forceflag) {
>   FILE *ucf;
>   char *filename = "/etc/postgresql/user_clusters";
>   char *buf, *curpos;
>   char *ptr;
>   char in[BUFSIZ];
>   char c_user[BUFSIZ], c_group[BUFSIZ], junk[BUFSIZ];
>   char line[BUFSIZ];
>   int c, found = 0, set_default = 0;
> 
>   /* create the line to write */
>   snprintf(line, BUFSIZ, "%s \t%s \t%s \t%s \t%s\n",
>            user, group, cluster,
>           (forceflag ? "yes" : "no"),
>           (db[0] == '\0' ? "*" : db));
>   line[BUFSIZ - 1] = '\0';
>   
>   /* start of user_clusters - open read-write */
>   sprintf(buf, "Failed to open %s for writing", filename);
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Where did you make 'buf' point to any usuable memory? Everything after
this is bogus...


>   for (curpos = buf; curpos != '\0' && !found; curpos += c) {
                       ^^^^^^^^^^^^^^

And this is almost certainly not what you want; assuming you're looking
for the end of a NUL terminated string, the expression you are looking for
is  "*curpos != '\0'".

But I'm guessing the problem is that "sprintf(buf,...)" call.

Steve

-- 
Steve Greenland
    The irony is that Bill Gates claims to be making a stable operating
    system and Linus Torvalds claims to be trying to take over the
    world.       -- seen on the net