<NinjaTrappeur>
hexa-: everytime I dig into that codebase, it ends up being a pretty unpleasant experience. It always makes me uneasy to know so much of the ecosystem relies on that piece of software.
<NinjaTrappeur>
I was confused: both patches are claiming to come from the same email. andi- suggested the maintainer might have altered the patch.
<NinjaTrappeur>
As long as we do not use NULL in any way to detect the boundary of the array, we'lle be ok.
<hexa->
yep, quite plausible
<hexa->
as long as we apply upstream patches :)
<andi->
that being all said I think the code is actually fine the way it is written. It is just a maint. burden I wouldn't want to have when mainting it..
<NinjaTrappeur>
Paranoid me added a note to my local git checkout to double check we still do not rely on NULL for boundary detection before next release.
<NinjaTrappeur>
yeah, sure. I was mostly worried about a vulnerability injected upstream here.
<andi->
as long as num_items fits into credentials we are fine as the function reading from the array actually doesn't check for NULL termination but takes the count
<andi->
It is a bit unfortunate that the array is the first thing on the stack as that means you could read/write into the other local variables but those aren't used after/while the array is written/send.