Hi Jeff, > Date: 2026-08-03 12:07:41-0400 > From: Jeffrey Walton <[email protected]> > > On Sun, Aug 2, 2026 at 5:35 PM Alejandro Colomar <[email protected]> wrote: > > > > [...] > > > > Most programmers can live in the safe bubble of <string.h>: those > > functions always require a string as input, and always provide a string > > as output. Plain and simple. It's difficult to write bugs when using > > those. > > I don't think it is simple to write safe (secure?) code using the > interfaces currently provided by libc.* Proof by counterexample: > CVE-2026-5358, > <https://sourceware.org/bugzilla/show_bug.cgi?id=34067>. If the libc > maintainers can't write secure code using the existing interfaces, > then there's little hope for the rest of us.
Agreed; I didn't mean that limiting oneself to the currently provided libc string APIs is safe. I meant that limiting oneself to APIs that strictly handle strings (including some APIs that are not currently provided by glibc, such as streq(3) and strscpy(9)) is safe (compared to using the non-string APIs. > [*] libc could provide safer interfaces, but it declined to provide > them. Confer, the lack of support for Annex K and the safer string > functions. (I'm aware of the politics and the past decisions by folks > like Ulrich Drepper). I don't think Annex K is safe at all. But certainly, some additions would be beneficial. Have a lovely day! Alex > > Jeff -- <https://www.alejandro-colomar.es>
signature.asc
Description: PGP signature
