linux-kernel - Re: [PATCH] alpha: Replace sprintf()/strcpy() with scnprintf()/strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250420002322.GP2023217@ZenIV>
Date: Sun, 20 Apr 2025 01:23:22 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Thorsten Blum <thorsten.blum@...ux.dev>
Cc: Richard Henderson <richard.henderson@...aro.org>,
	Matt Turner <mattst88@...il.com>, Arnd Bergmann <arnd@...db.de>,
	Geert Uytterhoeven <geert@...ux-m68k.org>,
	"Mike Rapoport (Microsoft)" <rppt@...nel.org>,
	Guo Weikang <guoweikang.kernel@...il.com>,
	linux-hardening@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Paul E. McKenney" <paulmck@...nel.org>,
	Alexander Gordeev <agordeev@...ux.ibm.com>,
	linux-alpha@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] alpha: Replace sprintf()/strcpy() with
 scnprintf()/strscpy()

On Sat, Apr 19, 2025 at 01:40:11PM +0200, Thorsten Blum wrote:
> Replace sprintf() with the safer variant scnprintf() and use its return
> value instead of calculating the string length again using strlen().
> 
> Use strscpy() instead of the deprecated strcpy().

FWIW, an idiomatic variant would be
	size = snprintf(NULL, 0, <....>);
	buffer = <allocate size + 1 bytes>
	if succeeded
		snprintf(buffer, size + 1, <....>);