From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,HTML_MESSAGE,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H2 autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 9370 invoked from network); 24 Oct 2022 07:52:09 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 24 Oct 2022 07:52:09 -0000 Received: (qmail 19583 invoked by uid 550); 24 Oct 2022 07:52:05 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 19544 invoked from network); 24 Oct 2022 07:52:03 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=d4adCrh2x7uM/0pdMfVAJfw+UXrAC8iJEtddIkbUGLU=; b=RW+NIg1kPdqB4LymFu1uPM3m4qyNV3BLE284T+6NE8HQHMpOHnqT8UHqMWs7PpVLP+ T6MM1o6/MrhG3b4xxxZJadgrqNOlLMzPzZBBKXzgqlOPkUB0+MvCK6JgPUOsCe94EVoW 3ktzB8Qs3o+/aMnPx0CtiFQEHdpQyZmW3eSZ4+dTjLRCotn612BDr4pn0X0BjeWA3RGf KON0l/AEUEj1llpv7HYoHEITfDEzKIHIlcvcDJXbN7KV+RZmu25z89jD/boqNF5civM8 EsP4kA6eaFPNnhDeEyREoPDgPZVqzaBnx3HXVBFaGlmRKZJL9Z07/XDAKl7EbmoL/KL+ HAwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=d4adCrh2x7uM/0pdMfVAJfw+UXrAC8iJEtddIkbUGLU=; b=MmVeRa6YyAvspB1I3RND24kTrdZu4aWmelgRDOWMsXuwBEmKa7o8pP1Az4I93QXgAE xUMSrR5vCLGhhQn8AYQtnFXK2Y7ON3hScRZs0gnJJKp64RDXd47zQP1AaSs8KW8xd+eq +/rKrV4+QtNQR+1bC6x/K8HsI+VgrWIgNqWV+Z5+hdb/qREkQbLFnA4VaXgqAVP6BRJG M7Vz9721BriOjzSggQAw+EaGwXZ+nw+ijZcwQ2ujgI9tnnMrnY7nb06ejCER+4vHO1dr QZJgy/20BVysJ3PskFbBfgvK0kX3bAyXhZ1zB+p8IN9DbeDWP3p4doZ+4lMT2nJyoJP5 wr/Q== X-Gm-Message-State: ACrzQf2KE9+KB3c54IARVBFPHrpmZ8UQVV1UoyQOcoh2lhA10qIH9nl3 TNzwM0CFiLSkNbEdys243KCF08JQQ2HEb9a330LfuuLxVdsi+g== X-Google-Smtp-Source: AMsMyM6I5ZJN7p3GrWtvXHxfr3IEMb0HG1N5Peq649F3ZIYZhLKjh5n0zvD38gnYJc6/kncialydy8UsKr1t5k6JrsQ= X-Received: by 2002:a17:90b:1d0f:b0:20d:1ec3:f732 with SMTP id on15-20020a17090b1d0f00b0020d1ec3f732mr36318526pjb.84.1666597911441; Mon, 24 Oct 2022 00:51:51 -0700 (PDT) MIME-Version: 1.0 References: <20221022135723.31813-1-ismael@iodev.co.uk> <20221023054622.GP29905@brightrain.aerifal.cx> <20221023141046.GM2158779@port70.net> <20221023151342.GQ29905@brightrain.aerifal.cx> <20221023170300.GS29905@brightrain.aerifal.cx> In-Reply-To: <20221023170300.GS29905@brightrain.aerifal.cx> From: "Konstantin P." Date: Mon, 24 Oct 2022 10:58:22 +0300 Message-ID: To: musl@lists.openwall.com Content-Type: multipart/alternative; boundary="0000000000007eb5a605ebc31055" Subject: Re: [musl] [PATCH] remove strdupa --0000000000007eb5a605ebc31055 Content-Type: text/plain; charset="UTF-8" systemd is using strdupa widely, and it is main reason why it should considered to stay. On Sun, Oct 23, 2022 at 8:03 PM Rich Felker wrote: > On Sun, Oct 23, 2022 at 11:13:42AM -0400, Rich Felker wrote: > > On Sun, Oct 23, 2022 at 04:10:46PM +0200, Szabolcs Nagy wrote: > > > * Rich Felker [2022-10-23 01:46:22 -0400]: > > > > On Sat, Oct 22, 2022 at 03:57:23PM +0200, Ismael Luceno wrote: > > > > > There's no portable way to implement strdupa without double > evaluation > > > > > of it's parameter, and it's use leads to vulnerabilities, since > there's > > > > > no chance to check for stack overruns. > > > > > > > > > > Signed-off-by: Ismael Luceno > > > > > --- > > > > > include/string.h | 1 - > > > > > 1 file changed, 1 deletion(-) > > > > > > > > > > diff --git a/include/string.h b/include/string.h > > > > > index 43ad0942edd5..65fe0d503004 100644 > > > > > --- a/include/string.h > > > > > +++ b/include/string.h > > > > > @@ -88,7 +88,6 @@ void explicit_bzero (void *, size_t); > > > > > #endif > > > > > > > > > > #ifdef _GNU_SOURCE > > > > > -#define strdupa(x) strcpy(alloca(strlen(x)+1),x) > > > > > int strverscmp (const char *, const char *); > > > > > char *strchrnul(const char *, int); > > > > > char *strcasestr(const char *, const char *); > > > > > -- > > > > > 2.38.1 > > > > > > > > Does anyone have strong opinions one way or the other on this -- > > > > especially distro folks who'd need to deal with the fallout? > > > > > > debian code search finds strdupa in 126 packages, > > > so it is widely used and not trivial to manually fix up, > > > i'd expect distros to just readd that definition to avoid breakage. > > > > Distros can of course add it with an ugly -D'strdupa(x)=...' in CFLAGS > > too, or with a one-line patch to the affected packages to add the > > #define. I would kinda expect some of these (likely any using > > autotools or especially gnulib) already handle the case where it's not > > defined and define their own, so maybe it wouldn't actually be that > > much breakage (but of course this would also be a reduction in > > bug-catching). > > > > I think a reasonable (but unsatisfying) outcome of this thread might > > end up being "do nothing until there's action to greatly reduce the > > number of packages using strdupa" (or at least evaluate the situation > > and determine that most would not break). I would really like to avoid > > "improving" interfaces that are harmful and slated for removal, but I > > also don't want to make unnecessary new burden on > > distros/integrators/users. > > Extra data points from discussion on #alpine-devel: at least MacOS and > FreeBSD lack a strdupa macro. This means pretty much anything using it > is either non-portable OS-specific software or already has checks and > fallback cases for when it doesn't exist. So the breakage from > removing it might be very low. > > Rich > --0000000000007eb5a605ebc31055 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
systemd is using strdupa widely, and it is main reason why= it should considered to stay.

On Sun, Oct 23, 2022 at 8:03 PM Rich Felk= er <dalias@libc.org> wrote:
On Sun, Oct 23, 20= 22 at 11:13:42AM -0400, Rich Felker wrote:
> On Sun, Oct 23, 2022 at 04:10:46PM +0200, Szabolcs Nagy wrote:
> > * Rich Felker <dalias@libc.org> [2022-10-23 01:46:22 -0400]:
> > > On Sat, Oct 22, 2022 at 03:57:23PM +0200, Ismael Luceno wrot= e:
> > > > There's no portable way to implement strdupa withou= t double evaluation
> > > > of it's parameter, and it's use leads to vulner= abilities, since there's
> > > > no chance to check for stack overruns.
> > > >
> > > > Signed-off-by: Ismael Luceno <ismael@iodev.co.uk>
> > > > ---
> > > >=C2=A0 include/string.h | 1 -
> > > >=C2=A0 1 file changed, 1 deletion(-)
> > > >
> > > > diff --git a/include/string.h b/include/string.h
> > > > index 43ad0942edd5..65fe0d503004 100644
> > > > --- a/include/string.h
> > > > +++ b/include/string.h
> > > > @@ -88,7 +88,6 @@ void explicit_bzero (void *, size_t);=
> > > >=C2=A0 #endif
> > > >=C2=A0
> > > >=C2=A0 #ifdef _GNU_SOURCE
> > > > -#define=C2=A0 =C2=A0 =C2=A0 =C2=A0 strdupa(x)=C2=A0 = =C2=A0 =C2=A0 strcpy(alloca(strlen(x)+1),x)
> > > >=C2=A0 int strverscmp (const char *, const char *);
> > > >=C2=A0 char *strchrnul(const char *, int);
> > > >=C2=A0 char *strcasestr(const char *, const char *);
> > > > --
> > > > 2.38.1
> > >
> > > Does anyone have strong opinions one way or the other on thi= s --
> > > especially distro folks who'd need to deal with the fall= out?
> >
> > debian code search finds strdupa in 126 packages,
> > so it is widely used and not trivial to manually fix up,
> > i'd expect distros to just readd that definition to avoid bre= akage.
>
> Distros can of course add it with an ugly -D'strdupa(x)=3D...'= in CFLAGS
> too, or with a one-line patch to the affected packages to add the
> #define. I would kinda expect some of these (likely any using
> autotools or especially gnulib) already handle the case where it's= not
> defined and define their own, so maybe it wouldn't actually be tha= t
> much breakage (but of course this would also be a reduction in
> bug-catching).
>
> I think a reasonable (but unsatisfying) outcome of this thread might > end up being "do nothing until there's action to greatly redu= ce the
> number of packages using strdupa" (or at least evaluate the situa= tion
> and determine that most would not break). I would really like to avoid=
> "improving" interfaces that are harmful and slated for remov= al, but I
> also don't want to make unnecessary new burden on
> distros/integrators/users.

Extra data points from discussion on #alpine-devel: at least MacOS and
FreeBSD lack a strdupa macro. This means pretty much anything using it
is either non-portable OS-specific software or already has checks and
fallback cases for when it doesn't exist. So the breakage from
removing it might be very low.

Rich
--0000000000007eb5a605ebc31055--