From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H2 autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 30005 invoked from network); 22 Oct 2022 00:27:08 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 22 Oct 2022 00:27:08 -0000 Received: (qmail 17667 invoked by uid 550); 22 Oct 2022 00:27:05 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 17626 invoked from network); 22 Oct 2022 00:27:04 -0000 Date: Fri, 21 Oct 2022 20:26:49 -0400 From: Rich Felker To: James Y Knight Cc: musl@lists.openwall.com, Ismael Luceno Message-ID: <20221022002649.GO29905@brightrain.aerifal.cx> References: <20221021211720.16465-1-ismael@iodev.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] [RFC PATCH] implement strndupa On Fri, Oct 21, 2022 at 06:09:42PM -0400, James Y Knight wrote: > > > > #define strdupa(x) strcpy(alloca(strlen(x)+1),x) > > +#define strndupa(x, n) strlcpy(alloca(strnlen((x), (n)), (x), (n)) > > > This causes the parameters to be evaluated multiple times -- and that is > also a problem with the existing strdupa. Unfortunately it's impossible to > implement these macros without multiple-evaluation, unless you use the GCC > statement-expression language extension (as glibc does). > > IMO, musl should either use that extension, despite the general policy of > avoiding such non-standard language extensions, or simply not implement > these functions at all. Implementing them, but having them incorrectly > multiply-evaluate the parameters seems like the worst of the options... These interfaces are basically *always a vuln* where used, and my leaning would be that we should remove strdupa and not add strndupa so as to get things using them fixed. The fact that they're macros and not ABI makes this doable. Rich