lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231019054642.GF14346@lst.de> Date: Thu, 19 Oct 2023 07:46:42 +0200 From: Christoph Hellwig <hch@....de> To: Justin Stitt <justinstitt@...gle.com> Cc: Keith Busch <kbusch@...nel.org>, Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@....de>, Sagi Grimberg <sagi@...mberg.me>, linux-nvme@...ts.infradead.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, ksummit@...ts.linux.dev Subject: the nul-terminated string helper desk chair rearrangement, was: Re: [PATCH] nvme-fabrics: replace deprecated strncpy with strscpy On Wed, Oct 18, 2023 at 10:48:49PM +0000, Justin Stitt wrote: > strncpy() is deprecated for use on NUL-terminated destination strings > [1] and as such we should prefer more robust and less ambiguous string > interfaces. If we want that we need to stop pretendening direct manipulation of nul-terminate strings is a good idea. I suspect the churn of replacing one helper with another, maybe slightly better, one probably introduces more bugs than it fixes. If we want to attack the issue for real we need to use something better. lib/seq_buf.c is a good start for a lot of simple cases that just append to strings including creating complex ones. Kent had a bunch of good ideas on how to improve it, but couldn't be convinced to contribute to it instead of duplicating the functionality which is a bit sad, but I think we need to switch to something like seq_buf that actually has a counted string instead of all this messing around with the null-terminated strings.
Powered by blists - more mailing lists