Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Banned C standard library functions in Git source code

github.com

Post reply on HN
Print view View original

141–150 of 329 posts

Re: Banned C standard library functions in Git source code

#141

Post by userbinator »

Good to see the list is short and relatively sane compared to other "banned function" lists. Unfortunately, "too easy to misuse" is a slippery slope, and gets(), which is probably the best example of a function which is really broken by design, isn't on that list.

I'm surprised that "complicate audits" is given as a reason, because isn't this something static analysers (and I mean ones that actually analyse data/code flow, not dumb pattern-matchers) can easily detect? It's really just asking the question "how long is this/can this be" and following the data back to its origin(s).

Re: Banned C standard library functions in Git source code

#143

Post by userbinator »

johannes1234321 wrote: post #132
crankylinuxuser wrote: post #80

Earlier quoted context omitted.

And that's the perfect usage for goto. Error catching and jump to fail block...

Goto requires the fail block to be in the same frame. It can be a working error strategy for failing critical errors in such a way from a failing module. You have to be aware that lots of stuff is prone to leak (which can be avoided by i.e. using some memory arena) and locks/mutexes/... might be in unclear state, so code has to be aware of that.

The destination of the goto is usually the clean-up code.

Re: Banned C standard library functions in Git source code

#144

Post by rkangel »

userbinator wrote: post #141

Good to see the list is short and relatively sane compared to other "banned function" lists. Unfortunately, "too easy to misuse" is a slippery slope, and gets(), which is probably the best example of a function which is really broken by design, isn't on that list. I'm surprised that "complicate audits" is given as a reason, because isn't this something static analysers (and I mean ones that actually analyse data/code…

C aliasing rules can very quickly make "following the data back to its origin" very difficult.

Re: Banned C standard library functions in Git source code

#145

Post by [deleted] »

IshKebab wrote: post #133
slovenlyrobot wrote: post #56

Earlier quoted context omitted.

These are used /everywhere/ in PostgreSQL, exactly for exception handling. The result isn't bad at all, but indeed, too powerful a tool for 99% of developers

You're in the 1% though right? Funny way of saying "too error-prone for anyone sane to consider using".

[deleted]

Re: Banned C standard library functions in Git source code

#146

Post by anilakar »

megous wrote: post #111
anilakar wrote: post #82

Earlier quoted context omitted.

Using musl as your standard library causes other problems, namely horrible Python performance and incompatibility with Valgrind.

What's slow in particular and on what arch?

Alpine. Slow in particular? I don't have the resources to profile everything in our codebase and find the root issue, but others have already benchmarked it: https://superuser.com/questions/1219609/why-is-the-alpine-do...

Re: Banned C standard library functions in Git source code

#147

Post by jasonhansel »

stiff wrote: post #11

Looks like Git has its own string type: https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.c See this for the story of why strncpy/strncat are insecure: https://en.wikipedia.org/wiki/C_string_handling#Replacements

Nice. Is there a similar standalone C library for safe/sane string handling? (Please don't tell me to use C++.)

Re: Banned C standard library functions in Git source code

#148

Post by userbinator »

bhk wrote: post #85
asveikau wrote: post #58

Earlier quoted context omitted.

I don't see a huge problem with strtok as long as it isn't a multi threaded program. It is not in gets territory which is literally impossible to use correctly.

Synchronous reentry is a problem. Say some loop using strtok calls a function... how do you know that that function doesn't use strtok (or call another function that does...). Any use of non-const static variables in general has this problem, and strtok is just one example.

how do you know that that function doesn't use strtok (or call another function that does...).

The same way you know a lot of other things about the codebase: By reading and understanding it. Given what strtok() is used for, it's almost always going to be working on a single context at any one time.

Re: Banned C standard library functions in Git source code

#149

Post by WalterGR »

dblock wrote: post #13

Windows programmers are familiar with StrSafe.h, https://en.wikipedia.org/wiki/Strsafe.h and https://github.com/dotnet/coreclr/blob/master/src/pal/inc/st... which go a lot further. Also found https://github.com/mubix/netview/blob/master/banned.h on Github with a better list.

IIRC, StrSafe.h - and much more - came from the development of the Microsoft Security Development Lifecycle (SDL).

Code Red was the wake-up call for Microsoft and in February 2002, based on a memo from Bill Gates that first coined the phrase "Trustworthy Computing," Microsoft shutdown Windows development for the first time ever to get a handle on the security issues the products were facing.

https://www.itprotoday.com/strategy/story-behind-microsoft-s...

Re: Banned C standard library functions in Git source code

#150

Post by Someone1234 »

saagarjha wrote: post #136
chris_wot wrote: post #92

Earlier quoted context omitted.

I've always wondered why goto is actually considered harmful. I really should read the original paper by Djikstra...

It encourages spaghetti code.

Not using it can also create spaghetti code. For example the "alternatives" often suggesting for exiting a multi-tiered loop (which often add additional boilerplate, additional variables, etc that all need to be maintained/bug free).
Post reply on HN