On Wed, Dec 6, 2023 at 3:18 PM Alejandro Colomar <alx@xxxxxxxxxx> wrote:
> Hi Matthew,
>
> On Wed, Dec 06, 2023 at 01:33:50PM -0500, Matthew House wrote:
> > I feel like this is rather overstating the difficulty. In practice, the
> > no-conversion condition is very commonly detected by checking whether
> > *endptr == nptr after the call. The usual idiom I see is something like:
> >
> > char *end;
> > errno = 0;
> > value = strtol(ptr, &end, 10);
> > if (end == ptr || *end != '\0' || errno == ERANGE)
>
> That test could trigger UB, if you passed an unsupported base. Of
> course, in this case you pass 10, but what if the base was a
> user-controlled variable? In such a case, nothing says what happens to
> 'end' (experimentally, I see it is not modified, so it would be left
> uninitialized); so dereferencing it, or even comparing it, would be UB.
>
> > goto err;
>
> Yeah, if you just don't care and want to handle all errors in the same
> way, and you know the base is supported, this is correct.
The practical answer is that the base is never ultimately a user-controlled
variable. Sometimes people define wrapper functions with a variable base,
but that base is still ultimately fixed by all its callers. If you disagree
with this, I challenge you to name a single example.
The theoretical answer is that you can just replace (errno == ERANGE) with
(errno != 0), or just (errno), if you still don't care about distinguishing
a base error. If you do care about distinguishing a base error, you can
just check its value directly, which, as I said, most people prefer over
trying to decode different funnily-named values of errno in my experience.
if (!(base == 0 || base >= 2 && base <= 36))
goto bad_base;
char *end;
errno = 0;
value = strtol(ptr, &end, base);
if (end == ptr)
goto not_a_number;
if (*end != '\0')
goto trailing_garbage;
if (errno == ERANGE)
goto overflow_error;
/* the last could also be, e.g., if (value < 0 || value > MAX_VALUE) */
Thank you,
Matthew House
