Banned C standard library functions in Git source code • Hacker News Board

Re: Banned C standard library functions in Git source code

#21

Post by noname120 » Sun, Aug 25, 2019, 2:39 PM UTC

Why is there no brief explanations in this code why each function is banned?

Re: Banned C standard library functions in Git source code

#22

Post by Kaveren » Sun, Aug 25, 2019, 2:41 PM UTC

slovenlyrobot wrote: post #8

That's a surprisingly small list, missing e.g. sscanf / gets / strtok / all the other "usual suspects" at least

Maybe gets doesn't need to be banned because it got removed in C11 and at least gcc issues a warning on use.

Re: Banned C standard library functions in Git source code

#23

Post by arcturus17 » Sun, Aug 25, 2019, 2:41 PM UTC

noname120 wrote: post #21

Why is there no brief explanations in this code why each function is banned?

Read the manual!

Re: Banned C standard library functions in Git source code

#24

Post by wyldfire » Sun, Aug 25, 2019, 2:42 PM UTC

noname120 wrote: post #21

Why is there no brief explanations in this code why each function is banned?

Collectively "because they're too easy to misuse (and even if used correctly, complicate audits)."

Re: Banned C standard library functions in Git source code

#25

Post by kevin_thibedeau » Sun, Aug 25, 2019, 2:42 PM UTC

noname120 wrote: post #21

Why is there no brief explanations in this code why each function is banned?

None are properly length checked. strncpy() is for "binary" strings and can omit the NUL in addition to excessive zero padding large buffers.

Re: Banned C standard library functions in Git source code

#26

Post by alister » Sun, Aug 25, 2019, 2:43 PM UTC

I'm glad to see that setjmp() and longjmp() are still allowed.

I'm just kidding by the way. For those C programmers who haven't encountered these before, it is a powerful way to do a "goto" in C. Powerful in the sense that you can jump anywhere, not limited to the same function. If it's used at all these days, it's used for exception handling.

More info: https://en.wikipedia.org/wiki/Setjmp.h

Re: Banned C standard library functions in Git source code

#27

Post by adamnemecek » Sun, Aug 25, 2019, 2:43 PM UTC

stiff wrote: post #11

Looks like Git has its own string type: https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.c See this for the story of why strncpy/strncat are insecure: https://en.wikipedia.org/wiki/C_string_handling#Replacements

Like essentially all C programs.

Re: Banned C standard library functions in Git source code

#28

Post by adrianN » Sun, Aug 25, 2019, 2:43 PM UTC

zsrxx wrote: post #5

jepler wrote: post #2

I guess they care too much about portability to use "pragma GCC poison"?

Wanting code to compile on something other than gcc is not "caring too much", it's being responsible

For this particular case it wouldn't be a big deal. The code is still valid C, it's just that GCC makes sure that you don't use the poisoned values.

Re: Banned C standard library functions in Git source code

#29

Post by calibas » Sun, Aug 25, 2019, 2:44 PM UTC

noname120 wrote: post #21

Why is there no brief explanations in this code why each function is banned?

I believe they're all vulnerable to overflows and easy to exploit.

https://pointerless.wordpress.com/2012/02/26/strcpy-security...

Re: Banned C standard library functions in Git source code

#30

Post by wruza » Sun, Aug 25, 2019, 2:45 PM UTC

MuffinFlavored wrote: post #7

For anybody else: Why is strncpy insecure? https://stackoverflow.com/questions/869883/why-is-strncpy-in... > strncpy() doesn't require NUL termination, and is therefore susceptible to a variety of exploits.

It also fills all remaining bytes (if any) with nuls. ‘N’ in its name is not the same ‘n’ as in snprintf etc. It could be named fldcpy, as it works with 0-padded fixed-width fields rather than 0-terminated strings.