Discussion:
CVS commit: pcc/arch
Iain Hibbert
2012-09-05 21:09:58 UTC
Permalink
sorry, I did not see any warnings.. what were they?
deprecated strcpy
How is it deprecated? It is listed in the C99 spec (section 7.21.2.3) and
also POSIX.1-2008 ...

While I appreciate that it could be used unsafely, that usage was not
unsafe.
Module Name: pcc
Committed By: mickey
Date: Wed Sep 5 15:12:19 UTC 2012
pcc/arch/amd64: local.c
pcc/arch/hppa: local.c
pcc/arch/i386: local.c
sorry ian but last change produced nothing but warnings
cvs rdiff -u -r1.71 -r1.72 pcc/arch/amd64/local.c
cvs rdiff -u -r1.38 -r1.39 pcc/arch/hppa/local.c
cvs rdiff -u -r1.163 -r1.164 pcc/arch/i386/local.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
--
paranoic mickey (my employers have changed but, the name has remained)
iain
ольга крыжановская
2012-09-05 22:15:08 UTC
Permalink
What is the replacement? M$ strcpy_safe_string_copy(char *dest, size_t
destsize, const char *src, size_t srcsize, size_t maxsize, size_t
safesize, size_t realsize, size_t upper_limit)?

Olga

PS: Yes, the prototype above is a mockery of M$'s "safe" APIs.
Post by Iain Hibbert
sorry, I did not see any warnings.. what were they?
deprecated strcpy
How is it deprecated? It is listed in the C99 spec (section 7.21.2.3) and
also POSIX.1-2008 ...
While I appreciate that it could be used unsafely, that usage was not
unsafe.
Module Name: pcc
Committed By: mickey
Date: Wed Sep 5 15:12:19 UTC 2012
pcc/arch/amd64: local.c
pcc/arch/hppa: local.c
pcc/arch/i386: local.c
sorry ian but last change produced nothing but warnings
cvs rdiff -u -r1.71 -r1.72 pcc/arch/amd64/local.c
cvs rdiff -u -r1.38 -r1.39 pcc/arch/hppa/local.c
cvs rdiff -u -r1.163 -r1.164 pcc/arch/i386/local.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
--
paranoic mickey (my employers have changed but, the name has remained)
iain
--
, _ _ ,
{ \/`o;====- Olga Kryzhanovska -====;o`\/ }
.----'-/`-/ ***@gmail.com \-`\-'----.
`'-..-| / http://twitter.com/fleyta \ |-..-'`
/\/\ Solaris/BSD//C/C++ programmer /\/\
`--` `--`
Thorsten Glaser
2012-09-06 07:37:43 UTC
Permalink
Post by ольга крыжановская
Post by Iain Hibbert
deprecated strcpy
[…]
Post by ольга крыжановская
Post by Iain Hibbert
While I appreciate that it could be used unsafely, that usage was not
unsafe.
Still, things like this should not be used *at all*, and software
that uses strcpy, sprintf and friends *at all* only shows how very
much not interested in modern/secure programming it is.

(For that matter, the link-time warning also appears in MirBSD.)
Post by ольга крыжановская
What is the replacement?
strlcpy(3) of course.

bye,
//mirabilos
--
“It is inappropriate to require that a time represented as
seconds since the Epoch precisely represent the number of
seconds between the referenced time and the Epoch.”
-- IEEE Std 1003.1b-1993 (POSIX) Section B.2.2.2
Szabolcs Nagy
2012-09-06 08:12:11 UTC
Permalink
Post by Thorsten Glaser
Post by ольга крыжановская
Post by Iain Hibbert
deprecated strcpy
[???]
Post by ольга крыжановская
Post by Iain Hibbert
While I appreciate that it could be used unsafely, that usage was not
unsafe.
Still, things like this should not be used *at all*, and software
that uses strcpy, sprintf and friends *at all* only shows how very
much not interested in modern/secure programming it is.
this is just fud

there is nothing wrong with strcpy
Post by Thorsten Glaser
Post by ольга крыжановская
What is the replacement?
strlcpy(3) of course.
don't use strlcpy

it is non-standard and wrong

if you need a safe string copy then use snprintf
that's at least standard (and able to handle the
error case instead of just silently truncating)
Szabolcs Nagy
2012-09-06 09:54:42 UTC
Permalink
Post by Szabolcs Nagy
don't use strlcpy
it is non-standard and wrong
if you need a safe string copy then use snprintf
that's at least standard (and able to handle the
error case instead of just silently truncating)
it seems i was wrong about the truncation handling

the other claims still stand:
i'd prefer strcpy usage when that's clearly
adequate or snprintf when long input should
be handled

pcc already has some bsd code dependency
so it's not extremely wrong to use strlcpy,
it's just unnecessary
Claudio Jeker
2012-09-06 10:04:15 UTC
Permalink
Post by Szabolcs Nagy
Post by Thorsten Glaser
Post by ольга крыжановская
Post by Iain Hibbert
deprecated strcpy
[???]
Post by ольга крыжановская
Post by Iain Hibbert
While I appreciate that it could be used unsafely, that usage was not
unsafe.
Still, things like this should not be used *at all*, and software
that uses strcpy, sprintf and friends *at all* only shows how very
much not interested in modern/secure programming it is.
this is just fud
there is nothing wrong with strcpy
Post by Thorsten Glaser
Post by ольга крыжановская
What is the replacement?
strlcpy(3) of course.
don't use strlcpy
it is non-standard and wrong
if you need a safe string copy then use snprintf
that's at least standard (and able to handle the
error case instead of just silently truncating)
Haven't loughed that loud for a long time.
You seam to have not learned from the past.
But the funniest thing is that strlcpy(a, b, sizeof(a)) is exactly
the same as snprintf(a, sizeof(a), "%s", b) including return values.
So how can be one wrong and bad and the other be right?

LOL
--
:wq Claudio
Szabolcs Nagy
2012-09-06 12:01:58 UTC
Permalink
Post by Claudio Jeker
But the funniest thing is that strlcpy(a, b, sizeof(a)) is exactly
the same as snprintf(a, sizeof(a), "%s", b) including return values.
So how can be one wrong and bad and the other be right?
no, they are not the same

snprintf is standard while strlcpy is not
so you have no guarantee about the semantics
of strlcpy, it can mean anything

but as i said it seems it works as expected
on systems where it's implemented
Theo de Raadt
2012-09-06 12:45:24 UTC
Permalink
Post by Szabolcs Nagy
Post by Claudio Jeker
But the funniest thing is that strlcpy(a, b, sizeof(a)) is exactly
the same as snprintf(a, sizeof(a), "%s", b) including return values.
So how can be one wrong and bad and the other be right?
no, they are not the same
snprintf is standard while strlcpy is not
so you have no guarantee about the semantics
of strlcpy, it can mean anything
but as i said it seems it works as expected
on systems where it's implemented
That is complete bullshit.

First of all, from our recently updated manual page:

RETURN VALUES
Besides quibbles over the return type (size_t versus int) and signal
handler safety (snprintf(3) is not entirely safe on some systems), the
following two are equivalent:

n = strlcpy(dst, src, len);
n = snprintf(dst, len, "%s", src);

Like snprintf(3), the strlcpy() and strlcat() functions return the total
length of the string they tried to create. For strlcpy() that means the
length of src. For strlcat() that means the initial length of dst plus
the length of src.

If the return value is >= dstsize, the output string has been truncated.
It is the caller's responsibility to handle this.

On all systems that have a function called strclpy in their libc, that
is how it works.

However, in your fiction world filled full of phantoms, some vendor is
going to add a strlcpy version to their libc that does a call to reboot(2).
Or eats children. Or calls random.

If anything, there may be versions of strlcpy out there that behave in broken
ways because they are broken, because people don't want to allow strlcpy to
become standard. Through words much like yours. By not letting strlcpy --
a 100% free piece of code we give to anyone -- gain spread as it should,
we are ending up with fresh new rewrites of it which may have bugs.

Is that what you mean? But that's got nothing to do with whether it
is in a standard or not. Operating systems have bugs in standards
"approved" functions all the time, too. Standards aren't pixy dust
that solve bugs.

So anyways, in reality, strlcpy has *exactly* the same behaviour of
snprintf, and I think you are just spreading hate.

By the way, you shouldn't use snprintf, if you want to put a fine
point on it. Completely without regard to 10 years of established
practice in the post-4.4BSD world, it was fine -- it returned the
number of bytes it wanted, just like it does now.

HOWEVER, the first official standard that documented it said that it
returned -1 on overflow! And a release of Solaris which behaved like
that shipped!

So something being standard doesn't mean it is right, either. I was
there -- fought to get that standard fixed before the problem went too
far, and we have the BSD semantics of > 0 for "string size required"
and the -1 semantic for encoding probelms.

I was there, making sure stuff was useable. While you are here, on
this list, like many others, simply spreading prejudice.
Szabolcs Nagy
2012-09-06 16:14:26 UTC
Permalink
pcc already uses strlcpy and other bsd functions, so there
is no issue, the strcpy warnings can be easily worked around
...
Post by Theo de Raadt
On all systems that have a function called strclpy in their libc, that
is how it works.
strlcpy is not wrong, i take that back
i did not research its semantics before writing my first mail

but using it in a portable application is not justified

yes the int return type is unfortunate in snprintf and it is
not required to be async signal safe by posix (nor other str*
functions in string.h), and yes the return value semantics
used to be broken

standards can be bad and their implementation more so,
in which case they need work arounds, but relying on them
is the best one can do when there is no control over the
platform that will host the application
Post by Theo de Raadt
I was there, making sure stuff was useable. While you are here, on
this list, like many others, simply spreading prejudice.
where were you when the iso c committee added annex k to c11?
you could have promoted openbsd's strlcpy instead of ms's strcpy_s
Theo de Raadt
2012-09-06 16:25:03 UTC
Permalink
Post by Szabolcs Nagy
pcc already uses strlcpy and other bsd functions, so there
is no issue, the strcpy warnings can be easily worked around
...
Post by Theo de Raadt
On all systems that have a function called strclpy in their libc, that
is how it works.
strlcpy is not wrong, i take that back
i did not research its semantics before writing my first mail
but using it in a portable application is not justified
In all facets of life new good things must be used by people based on
their purpose instead of false prejudice, and that way they can
eventually be pushed up to common acceptance, we'd still be living in
the dark ages.

strlcpy has saved tons of software from buffer overflows. Perhaps you
were not on BUGTRAQ in 1998. It was built so that anyone can use it.
Other attempts at 'better string' functions came out at the same time,
but all of them are gone. Only one could be used easily and safely by
idiots, yet also has a powerful return value that experts can use in
smart ways.

strlcpy is everywhere, except for glibc and standards. One nasty
person who has been mandatory-retired ages ago stood up against
strlcpy, and lots of people showed that they can't think clearly and
prefer to follow.

Just go grab a lock ports tree, check out the entire tree, and
grep it.

Count the strlcpy's.
Count the snprintf's.
Count the malloc's.

There are thousands of applications with strlcpy in them; often their
own copy. Developers of big software packages are living in near-terror
because using strncpy safely every time is too mind-numbingly annoying,
and almost all of them have chosen to have their own private copy since
it is not yet in one library -- glibc.

Are you going to tell Linus that there is no justication for the
use of strlcpy and strlcat inside the Linux kernel? Please -- do
send him such a mail. You'll get flamed. He gets it.

It is in perl. Did they do something wrong? How unjustifiable.

Using it in a portable application IS JUSTIFIED. That's the way
it will eventually get into "printed" standards, and beyond the
current "defacto standard" it is.

Michael Shalayeff
2012-09-06 01:20:44 UTC
Permalink
Post by Iain Hibbert
sorry, I did not see any warnings.. what were they?
deprecated strcpy
How is it deprecated? It is listed in the C99 spec (section 7.21.2.3) and
also POSIX.1-2008 ...
While I appreciate that it could be used unsafely, that usage was not
unsafe.
on openbsd it produces a warning on linking.
Post by Iain Hibbert
Module Name: pcc
Committed By: mickey
Date: Wed Sep 5 15:12:19 UTC 2012
pcc/arch/amd64: local.c
pcc/arch/hppa: local.c
pcc/arch/i386: local.c
sorry ian but last change produced nothing but warnings
cvs rdiff -u -r1.71 -r1.72 pcc/arch/amd64/local.c
cvs rdiff -u -r1.38 -r1.39 pcc/arch/hppa/local.c
cvs rdiff -u -r1.163 -r1.164 pcc/arch/i386/local.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
--
paranoic mickey (my employers have changed but, the name has remained)
iain
--
paranoic mickey (my employers have changed but, the name has remained)
Iain Hibbert
2012-09-06 08:22:47 UTC
Permalink
Post by Michael Shalayeff
Post by Iain Hibbert
sorry ian but last change produced nothing but warnings
sorry, I did not see any warnings.. what were they?
deprecated strcpy
How is it deprecated? It is listed in the C99 spec (section 7.21.2.3) and
also POSIX.1-2008 ...
While I appreciate that it could be used unsafely, that usage was not
unsafe.
on openbsd it produces a warning on linking.
Is there no way to mark this usage as correct?

Otherwise, when you use an intentionally broken tool, you are bound to
ignore the spurious warnings that it produces!

You must be aware that strcpy() is used elsewhere in pcc sources.. it is
the exact function required for the task here (though the less prevalent
stpcpy() would also have been useful); its use is to copy a NUL terminated
string into a buffer which we know is large enough to receive it. There is
no overflow possible, and I do think that using it is cleaner than
inserting the equivalent code..

regards,
iain
Thorsten Glaser
2012-09-06 10:45:33 UTC
Permalink
Post by Iain Hibbert
Is there no way to mark this usage as correct?
Yes.
Post by Iain Hibbert
Otherwise, when you use an intentionally broken tool, you are bound to
ignore the spurious warnings that it produces!
This is not spurious. Presence of strcpy in a program indicates
a mistake, always. Period.
Post by Iain Hibbert
You must be aware that strcpy() is used elsewhere in pcc sources.. it is
I think I either patched that somewhere locally out, or I can
whip out a patch doing that. Might be the best.

bye,
//mirabilos
--
<Natureshadow> Dann mach ich git annex copy --to shore und fertig ist das
<Natureshadow> das ist ja viel cooler als ownCloud ...
<mirabilos> sag ich doch
<Natureshadow> ja wieso stimmt das denn immer was du sagst ...
Iain Hibbert
2012-09-06 11:29:21 UTC
Permalink
Post by Thorsten Glaser
Post by Iain Hibbert
Is there no way to mark this usage as correct?
Yes.
So then: can this not be done for code that clearly is correct?
Post by Thorsten Glaser
Post by Iain Hibbert
Otherwise, when you use an intentionally broken tool, you are bound to
ignore the spurious warnings that it produces!
This is not spurious. Presence of strcpy in a program indicates
a mistake, always. Period.
I'm sorry; but such religious arguments are not good in a technical
context. The presence of strcpy and/or stpcpy are not always a mistake, as
they are useful functions when used correctly. The code I wrote could have
been written as

strcpy(stpcpy(s, name), postfix);

and this would have been perfectly proper in that context. However,
provision of stpcpy() is not widespread..

If you truly believe there was an actual error in the code, please point
to it!

regards,
iain
Thorsten Glaser
2012-09-06 10:47:12 UTC
Permalink
Post by Iain Hibbert
its use is to copy a NUL terminated
string into a buffer which we know is large enough to receive it.
In that case, use memcpy, not strcpy. The FSF nowadays do:

cp = xmalloc(strlen(s) + 1);
memcpy(cp, s, strlen(s) + 1);

(In some variant, possibly caching intermediate values.)

bye,
//mirabilos
--
[...] if maybe ext3fs wasn't a better pick, or jfs, or maybe reiserfs, oh but
what about xfs, and if only i had waited until reiser4 was ready... in the be-
ginning, there was ffs, and in the middle, there was ffs, and at the end, there
was still ffs, and the sys admins knew it was good. :) -- Ted Unangst über *fs
Iain Hibbert
2012-09-06 11:17:43 UTC
Permalink
Post by Thorsten Glaser
Post by Iain Hibbert
its use is to copy a NUL terminated
string into a buffer which we know is large enough to receive it.
In that case, use memcpy, not strcpy.
This is my intention, since there is a religous objection to strcpy()

iain
Loading...