Re: CVS commit: src/crypto/dist/openssl/apps

[David Laight <david%l8s.co.uk@localhost>]

On Wed, Apr 15, 2009 at 12:40:26AM +0700, Robert Elz wrote:
>     Date:        Tue, 14 Apr 2009 16:11:13 +0200
>     From:        Joerg Sonnenberger <joerg%britannica.bec.de@localhost>
>     Message-ID:  <20090414141113.GD952%britannica.bec.de@localhost>
> 
>   | toupper() gets u_char arguments, not int. This cast is simply wrong.
> 
> According to TFM ...
> 
> SYNOPSIS
>      #include <ctype.h>
> 
>      int
>      toupper(int c);
> 
> and
> 
> CAVEATS
>      The argument to toupper() must be EOF or representable as an unsigned
>      char; otherwise, the behavior is undefined.
> 
> If EOF is to be a valid parameter to toupper(), then the arg type
> cannot be u_char - however much you'd like it to be.

The cast added is definitely the wrong one.

The 'char' value 'row[...]' must not get promoted to a negative value
when used in toupper() - otherwise a -ve value can result and the behaviour
is undefined.

Looking at that function - it is absolutely horrid.
It almost contains:
        foo[strlen(foo)] = 0;

        David

-- 
David Laight: david%l8s.co.uk@localhost