linux-ext4 - Re: [PATCH] ext4: use strlcpy() instead of strncpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a1xGW+KmtaqQfuARTn2zwJ3J6fZrLqTchstJcvGPj_BEQ@mail.gmail.com>
Date:   Wed, 10 Jan 2018 22:30:15 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     "Theodore Ts'o" <tytso@....edu>
Cc:     Xiongfeng Wang <wangxiongfeng2@...wei.com>,
        Jan Kara <jack@...e.cz>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        linux-ext4@...r.kernel.org
Subject: Re: [PATCH] ext4: use strlcpy() instead of strncpy()

On Tue, Jan 9, 2018 at 9:20 PM, Theodore Ts'o <tytso@....edu> wrote:
> On Tue, Jan 09, 2018 at 07:14:36PM +0800, Xiongfeng Wang wrote:
>>
>> Sorry, I didn't notice how s_last_error_func is used before.
>> We do waste one character if we use strlcpy() instead of strncpy().
>> We can't use memcpy() either. But I can't  figure out a better way to avoid
>> this warning.
>
> Compain to the GCC developers?   Create scripts that filter out crap?

This warning option appears to be particularly good in finding code that
is actually dangerous in case of an overflow, and generally using
strscpy() improves either correctness and readability over strncpy(),
I think it's worth leaving enabled globally.

I have an experimental patch series to let you wrap the _Pragma("GCC
diagnostic ingnored \"-Wstringop-truncation\"") directive in some
nicer syntax. Would that work for you here?

       Arnd