Re: [resend 04/10] reg: Add sane_path function to do preliniary key validation

[Stefan Dösinger]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I was on holiday when you sent these patches, sorry for the late review.

Am 2014-12-13 um 18:06 schrieb Jonathan Vollebregt:
> +static LSTATUS sane_path(const WCHAR *key)
> +{
> +    if (key[0] == '\\' && key[1] == '\\' && key[2] != '\\')
> +        return ERROR_NO_REMOTE;
> +
> +    return ERROR_SUCCESS;
> +}
> This adds (or rather extends) a possible out of bound array access.

Otherwise these patches look reasonable to me and worth review by others.

A general note on the error handling code for other reviewers: Native reg.exe has very limited error reporting. With a few exceptions it just prints a generic message like "ERROR: INVALID SYNTAX" or something similar.

I guess there are also some possible improvements on the output code as Bruno mentioned, but I think patch 3 is OK until (if ever) we have unified console output handling for all command line programs.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJUrEB5AAoJEN0/YqbEcdMw8bUP/1dhlLDCE2kOZhLkhVXg0RVa
BckpiGygdwfIIvGoyCaj6ObtgvrnYr7OMzZsruytK/X5UUvl+KsObctp8g1zjNY1
dFPQeBsra9TRtbtKTMX2pIdZS1wSNwWaOYrdZcKn5IkQfDWN0rwdKNujT8pAf+Ik
8dpFJUYtMjd6N0avPqphglRbW8rFhLhqYOlYuPjvzuEtBM11vGfy9mAp+sPA1ekX
8sRqGtn65w1JsT3cg054DvtY2xHNmRE5eTnrsbL7gqD/oljdPyU470eY6Vwofo3Z
frAF8OKemJsU6MrxZLXe1US5GzyvvCRRpIBNcfrO6qzTTdio0/LBe77VDq9J0jAa
GUWYFUtxIXw7Ccw1tNrxYp1JPo9bZnk5yONMMEAPfw2ij2iQCTvpv0lY9Kk58mqF
kKzWrqzhVdi5aFGOGhnmrk7NZ4l8paA7Gk2S1c8IukWubww0hlOclrhrWDYpuEfJ
ZKyGG8jFUvSjW3iTEES7NHMnCd+lWgaf+3TODrSGD5J/wdP6GQT9S78/HZ+SbM8m
fxnvnDLylq9arQm3bh0wQy9ZoMCTMx4YtbTouQBpLZBDKAgZNK1BUC5sxP1NlO9P
eP5JAZFHTzpGXCADkL+4OI4+ImG9mAMWGYytHGEQ3kwvAucNwTWP00twzMbSjHEX
+8k+frQxyupijPZrL4vo
=PJFk
-----END PGP SIGNATURE-----

[resend 04/10] reg: Add sane_path function to do preliniary key validation

[Stefan Dösinger]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 2015-01-06 um 21:07 schrieb Stefan Dösinger:
> Am 2014-12-13 um 18:06 schrieb Jonathan Vollebregt:
> > +static LSTATUS sane_path(const WCHAR *key)
> > +{
> > +    if (key[0] == '\\' && key[1] == '\\' && key[2] != '\\')
> > +        return ERROR_NO_REMOTE;
> > +
> > +    return ERROR_SUCCESS;
> > +}
> > This adds (or rather extends) a possible out of bound array access.
> > Actually, never mind that, as discussed on IRC. If the string is too short key[0] or key[1] won't be '\\'. Still it looks somewhat odd, but the next patch adds an explicit length check.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJUrEEAAAoJEN0/YqbEcdMw1FUQAIZWTWbqtX8CvA+26vpsRDKL
sY96cCXSONaWSgYK/8ScIE1wFM2VEzvCe8y3ShsJjtrjOTpKy/lNn+S46RsDzanC
PlXdr9j8h2QO8pJRVVRgqkO6Ch+QZYI2Sk8ICOEumVMERE8KzSQNLLqSDzO/+JOO
cnQsswRqvC4Mai9pEMx/jLD0fSNJAALzJt8aQDv2S8C2pZdaTWCQPGDJboPewGjL
JmsrtorcS6VMFgW7lFobIw476sJ9gBaqykyiEkwSV/+kTN0rRLZJDTvzs9a3kwMD
VzVuxNbxig/udxJnOW1yyRCMEIimBui/Apotbhg/FdpIatKvL5X4CEz3ms9b93Dp
8wCUNTuE4zblmNfr09c+bGmD157DwV02C6FfXLBoxMbLaNVkhe2zN6CONHxJDgkk
5UShkHhT8xKclnSpt9Uw77+4T/swcaae02mO9OfqbxnQrBahkQ3GbGy8Qs8uENlh
HAKXuFMRe2BZBmnGPOx1wG0L3kUIBxB/zpZb8ByAGD/xxlvef+QXtznWsqaCes3m
kG8/ndc+0ZpDAlNjsXIXXUrTOFguchS3tjMsivjVfFgt8o4WwcWCmPsoYHNAWNGD
tl31KlRIAtq7elSv1zGq4Bwntg1gUdNk5yqCZBjMflZB3gr4MqRPqu56P/hionpr
KCq+v5IRqUGrJhlExrV9
=FL8R
-----END PGP SIGNATURE-----