On Tue, 2019-07-23 at 16:37 +0200, Rasmus Villemoes wrote: > On 23/07/2019 15.51, Joe Perches wrote: > > Several uses of strlcpy and strscpy have had defects because the > > last argument of each function is misused or typoed. > > > > Add macro mechanisms to avoid this defect. > > > > stracpy (copy a string to a string array) must have a string > > array as the first argument (dest) and uses sizeof(dest) as the > > count of bytes to copy. > > > > These mechanisms verify that the dest argument is an array of > > char or other compatible types like u8 or s8 or equivalent. > Sorry, but "compatible types" has a very specific meaning in C, so > please don't use that word. I think you are being overly pedantic here but what wording do you actually suggest? > And yes, the kernel disables -Wpointer-sign, > so passing an u8* or s8* when strscpy() expects a char* is silently > accepted, but does such code exist? u8 definitely, s8 I'm not sure. I don't find via grep a use of s8 foo[] = "bar"; or "signed char foo[] = "bar"; I don't think it bad to allow it. > > V2: Use __same_type testing char[], signed char[], and unsigned char[] > > Rename to, from, and size, dest, src and count > > count is just as bad as size in terms of "the expression src might > contain that identifier". But there's actually no reason to even declare > a local variable, just use ARRAY_SIZE() directly as the third argument > to strscpy(). I don't care about that myself. It's a macro local identifier and shadowing in a macro is common. I'm not a big fan of useless underscores. I think either works.
