From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 23986 invoked from network); 26 Aug 2023 20:59:01 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 26 Aug 2023 20:59:01 -0000 Received: (qmail 22412 invoked by uid 550); 26 Aug 2023 20:58:56 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 22377 invoked from network); 26 Aug 2023 20:58:55 -0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nGh7vEe+zrr0rY3ygMm+SudC/7ocrE9HYQ9vaA9QiNirlIFinWKI6T4rDqY0fT71XJT0Vg6XvqS2ow9K+/lfQO8pJYkrBECBE8ktlBNObAlHHEBt389a6QnKl0/YqrSbOgQAjZIUXXHcyHaF9OiVzeMx0B1gpVG5dX8t6TqAdDuA0ReGhJrnZlk/Vn+mOqt8iWtBguGO7d/pCtS/Wqt1ozPl3ENzIkYBTRl1AYMlvfw0DRI4zH6byA93NfGuLyipixCtUrYVJbokQ+kbXnvekA43VxeVwG1XToXrDVAe9S/HVubpHILBTbmbxTuve5vhy9wpe+JlkescGIfYLNem1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ShM5f2hlG8qfXowb1n5SCB7w53k82qmkUYdLGwbttW0=; b=B26G2rjjZogC5LRYGgy+7FsHp0PI+htUOwJb8qQgoBaoBZmWo6fEcjJvleYxwbPuPGqg65e4rw1kWHuyCT0dXe3t10yYzndYXk0paIFHlqwd9M8UeoP7AbjdXottvG5jz6SHEq4kon535arvZ9pxLxolKQHKJumNwmhlkLid+Mtag0KqNSZEFKosSJz9xu+wEX+N0Gd+VIVrz9niOdBaLH7VjJXNEz3TFEehjbyB3jcI+W/Y1WeZSaBeyGWHiQUF3zPBpCM9ql/Ew7kQ0wlcZWgUWSDfr3mmRD2hnrstVvi21/I2cn9XwvrBag5/owa6X4TKFyxxQul1KjI0mv0jyw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none X-Gm-Message-State: AOJu0Yxcef0KcTGvr8TKgHzIAd3BkZCuD1q6DoqUgZtuhp+Z3i4WXvoV /EGnWXtx2A+YXWJfvlXoD+/AOp7sSAkSH095XTE= X-Google-Smtp-Source: AGHT+IH27QR1hMhXzzfOgzrvPiAhUqP/2h2qYxrCija4ugZRNPoZAk0Bso4a+Ln2rHWW0bTzcObGGUm5Qafc2rELujA= X-Received: by 2002:a1f:4983:0:b0:48d:659:102c with SMTP id w125-20020a1f4983000000b0048d0659102cmr18349373vka.13.1693083517008; Sat, 26 Aug 2023 13:58:37 -0700 (PDT) References: <20230529123202.63f09fc2@inria.fr> <20230529155929.GV4163@brightrain.aerifal.cx> <20230529211059.19111ab9@inria.fr> In-Reply-To: <20230529211059.19111ab9@inria.fr> From: Fangrui Song Date: Sat, 26 Aug 2023 13:58:26 -0700 X-Gmail-Original-Message-ID: Message-ID: To: musl@lists.openwall.com Cc: Rich Felker , =?UTF-8?B?SuKCkeKCmeKCmyBHdXN0ZWR0?= Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-TMN: [50xG2jNQ1CK43pqyluCPbFwmIuT7E9il] X-ClientProxiedBy: BN9PR03CA0939.namprd03.prod.outlook.com (2603:10b6:408:108::14) To DS7PR12MB5765.namprd12.prod.outlook.com (2603:10b6:8:74::19) X-Microsoft-Original-Message-ID: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS7PR12MB5765:EE_|BL1PR12MB5754:EE_ X-MS-Office365-Filtering-Correlation-Id: 86ac1138-566a-4462-2d14-08dba6773914 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Upj7RhsSk0RNTSAAMvy7Vqg3CEgtCnfNGBEHw6rBJhgraJiMB/gPLZd4hF6CTgoceWrG0dTsFHLyHDx4fX5LrR83laVU15IVxNcJ7hQ1p1GmwXuHDsH2IarumMeUgvnoZB0dx10Hfak/24qQye7V1tr0HPbuuzYanlSRnDfItrarlJjRlkBjt0ukkf5qbJ8t+RX7TCiGtJFKhLbpPokwqEXStoJwkIdIiYTcqGI3o2hW/ol2biwANHpvwo5+4t8baFGOSEY2hdSuBZzkYYdHF9s0CSQqt8PZjt98biOhsPbXZwF0P29Y7XObFXIMiHGQwAznMl1075Z33TiIVzwtEHmPiQ0AY0+ErJBZcGXTrhFrHYHGN4baNxTrBLhTUbUs4FsFdHWyVXq6ZqTZlAcrrUZmruuD1mDe9+/gvoRwW0KcllXkTbDQ8dCzsXs8JdZCmL3mQ9C+b/0dGcgEbCizg9PHbd1Jyr0Ot80wSxMicLVuyqPOPCOCdQ9HiboKpm2yBXraj/YSS0X3usocYrUj2tYD49f6Fw7j4gLMPDdtjy4= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TmN4eGhJZFhiUEdSdmd1RVNaWEJRT1FQS1Rva3pTVjBTNlppcDV6bnc2TTRF?= =?utf-8?B?S1NtdXZMdWFqOWIvTSt3ekpOTDdLMVl2K3RyUFRSd041TUVPc3pwVnRrbmpN?= =?utf-8?B?VkgzVzNpTUtYTk5zRXZRU0Zkb1hBUzUrRnc2UUpFc2V2WnFlRHIwV0h0RWgv?= =?utf-8?B?NEF0MDJKU0JTYmJ3S05FTUt0SElUMlQ2NVdGcEcxOFpkU3lOb2JINWVEMTUv?= =?utf-8?B?TXhzMWpaYnl2ZXVJYU8wcTNGdk5VTVJsaDlFcUFoTkhaeHFya0ZjRW80QU5H?= =?utf-8?B?VG44cktTQWlLVkdVdkVBditscHhrMVFTK082VUNnQTdSMXZRWjkzNGpkVG1N?= =?utf-8?B?ZWVjUmtaZEpQUmN6ZU9iL1VHZi9wbGlxNE1RZTkvaWE3NHlUdTRpVjJsVGkw?= =?utf-8?B?ZGdxaUZoWWtVRGtNUGcvWjl4RVovVEpCZmZrelV3cUpRWDYzZ1R0Tjdpem4r?= =?utf-8?B?bEFUMzd5MS9KU2kzVDlrTjhOUjFsT3VWdkRhQXZ4Q1M1YWU0ZGpOVXdaN21O?= =?utf-8?B?L0JsSjVpeHJ5bzkzZnFJb2lDREFWWFRnYzVMMytNY1FaUXB2b0YrYmM3dW0w?= =?utf-8?B?QUxxSG85Uk1ZZzNIVzFFMVVvSFJJRWNqelYzaVJxT2d5MWVPLzlhb1ZQQ0xP?= =?utf-8?B?VlQvY1lBQWlvM1Blcms4blMrL3RXbXkwWGtud255VTN0VFF2cnNlSzRydzdy?= =?utf-8?B?UnBYTmkrQkFRSXh3Uk4zK1hseGkxMTNEM2xjWjhsMFVNUEFtNHRsRk5nTVNJ?= =?utf-8?B?Nk5HRy96NXMrUGQ3TEpqZEJKZ3BUZzl3RmMrWWd6YU1iam5jQzFSeEdHSkFx?= =?utf-8?B?SkJWRi9VditpdVBEYjA5aWZ6Z21hb3R0czR4TGpRYktGWEVFUTNIWDB1RkpC?= =?utf-8?B?c01nQWIxdjJqbTZGVXpvcExIL3NrRHRkUjFHNXN5bTJnRWQzWWUxZUNFQmZp?= =?utf-8?B?SmdkemN3MDY4cjhEY0NLN2NJaVRYRXF5YjNuR1NCWGZFdjZ1RTVUNDR5NW1v?= =?utf-8?B?YnNrMlRIRG5qY0xTV21HQ2JSR0pZVDdtTXJuaFBBRmUwWUY3ZlJTVURsM1Fy?= =?utf-8?B?VTczMEpaT2FBRGdEbGpTUXpYWmsyY01lRXR2VjFCZyt6NXZFVVdJSTFGbXc4?= =?utf-8?B?b0szMVp4dXV6aTFUZ0dQdFZhM2FxVVZkdkFqS3Nub3lqeWx5NS95QURudm1j?= =?utf-8?B?anNsTHdHdjVUcmEwNUdVUjdRNWFiZkNkbVEzSHJlSW5GWTRZTmRJaCtPbUk3?= =?utf-8?B?VjNpL01qTU1kcU1GSGhVNEdIcXJyRGtvbHJqYU9YRy9wUk9NQ29YdXNuYy9v?= =?utf-8?B?RHQwY0hodm41MHQ3Z3oxYUkwUUl5bTR2WE8yelZSTkowdTE3RnZoRFp0R0Rv?= =?utf-8?B?UmExWjFvd293L1FtRGRxSU9GYkxFVjRzcHo1dGdwb2YvL3VVNDhYQnZzS3B6?= =?utf-8?B?d0MyQnNjRmJVaUhEQ3hnN2dyeG1qNjRxUWc2U0E3bXkzTytveUpZbk9UM05p?= =?utf-8?B?Ung2ZjFxa0JNbGYrblA5T0lIVGo3OUM1UFF2N0pGd00zRUxrZjF4SHJkM1lk?= =?utf-8?Q?fseiHpJxEJSCsPbhvXqzQgxb5c6goj2hoVsJp4P6AZWiqK?= X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-71ea3.templateTenant X-MS-Exchange-CrossTenant-Network-Message-Id: 86ac1138-566a-4462-2d14-08dba6773914 X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB5765.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Aug 2023 20:58:39.4516 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5754 Subject: Re: [musl] changes for scanf in C23 On Mon, May 29, 2023 at 12:11=E2=80=AFPM J=E2=82=91=E2=82=99=E2=82=9B Guste= dt wrote: > > Rich, > > on Mon, 29 May 2023 11:59:29 -0400 you (Rich Felker ) > wrote: > > > On Mon, May 29, 2023 at 12:32:02PM +0200, J=E2=82=91=E2=82=99=E2=82=9B = Gustedt wrote: > > > Hi, > > > we already discussed this but it doesn't seem that we have come to a > > > conclusion. > > > > > > The problem is that for C23 semantics of several string to integer > > > conversion functions change: a 'b' or 'B' that previously was the > > > stop condition for integer parsing may become part of the integer > > > string. This concerns all `scanf` and `strto` derivatives. > > > > > > This is probably not a problem for most applications that parse > > > strings to integers, but it could be in some situations, and in > > > particular it could open vulnerabilities. E.g network addresses that > > > are read with base `0` (musl does this at some point to allow to > > > have decimal or hex strings) could be open to attacks, once people > > > start using binary encodings for integers more often. Another > > > scenario where this could lead to harm is automatically produced > > > output that is automatically scanned, and where nobody previously > > > took care of proper word boundaries. > > > > > > My current idea is to have two sets of these functions, one that has > > > the old semantics and one that has the new. > > > > This was rejected already in the first proposal (thread here): > > > > Message-ID: <20230503000045.GU4163@brightrain.aerifal.cx> > > https://www.openwall.com/lists/musl/2023/05/03/1 > > > > "There are not going to be different versions of scanf/strto* > > because there's just no way to do that in a conforming way..." > > Alright, saves me a lot of trouble. I'll forward all complaints by > users to you ;-) > > J=E2=82=91=E2=82=99=E2=82=9B > > -- > :: ICube :::::::::::::::::::::::::::::: deputy director :: > :: Universit=C3=A9 de Strasbourg :::::::::::::::::::::: ICPS :: > :: INRIA Nancy Grand Est :::::::::::::::::::::::: Camus :: > :: :::::::::::::::::::::::::::::::::::: =E2=98=8E +33 368854536 :: > :: https://icube-icps.unistra.fr/index.php/Jens_Gustedt :: Nice! Not introducing new symbols saved me time on https://reviews.llvm.org/D158943 (sanitizer patch to intercept glibc 2.38 introduced __isoc23_strtol and __isoc23_scanf family functions for binary compatibility).