mailing list of musl libc
 help / color / mirror / code / Atom feed
* [musl] changes for scanf in C23
@ 2023-05-29 10:32 Jₑₙₛ Gustedt
  2023-05-29 15:59 ` Rich Felker
  0 siblings, 1 reply; 4+ messages in thread
From: Jₑₙₛ Gustedt @ 2023-05-29 10:32 UTC (permalink / raw)
  To: musl

[-- Attachment #1: Type: text/plain, Size: 2161 bytes --]

we already discussed this but it doesn't seem that we have come to a

The problem is that for C23 semantics of several string to integer
conversion functions change: a 'b' or 'B' that previously was the stop
condition for integer parsing may become part of the integer
string. This concerns all `scanf` and `strto` derivatives.

This is probably not a problem for most applications that parse
strings to integers, but it could be in some situations, and in
particular it could open vulnerabilities. E.g network addresses that
are read with base `0` (musl does this at some point to allow to have
decimal or hex strings) could be open to attacks, once people start
using binary encodings for integers more often. Another scenario where
this could lead to harm is automatically produced output that is
automatically scanned, and where nobody previously took care of proper
word boundaries.

My current idea is to have two sets of these functions, one that has
the old semantics and one that has the new.

 - Newly compiled objects that don't do fancy stuff (such as
   `(scanf)(...)` or `#undef scanf`) would see hard-coded linker
   symbols such as `scanf-c17` or `scanf-c23` according to the
   standard's version they compile against. When linking statically,
   this would just chose that one particular set of functions. The
   dynamic library would always have both versions, to accomdate
   objects that have been compiled with any standard's version.

 - Old compiled objects and executables as well as those where users
   chose to `#undef` or use their own headers/prototyes would receive
   a default (something like: starting with version X, musl uses C23
   semantics), but which could be overwritten under the responsibility
   of the provider of the compiled musl library.


:: ICube :::::::::::::::::::::::::::::: deputy director ::
:: Université de Strasbourg :::::::::::::::::::::: ICPS ::
:: INRIA Nancy Grand Est :::::::::::::::::::::::: Camus ::
:: :::::::::::::::::::::::::::::::::::: ☎ +33 368854536 ::
:: ::

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2023-08-26 20:59 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-29 10:32 [musl] changes for scanf in C23 Jₑₙₛ Gustedt
2023-05-29 15:59 ` Rich Felker
2023-05-29 19:10   ` Jₑₙₛ Gustedt
2023-08-26 20:58     ` Fangrui Song

Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).