3 ms·

> At what point does it become reasonable to conclude that strncmp, and every other string API that treats the pointer to the string and its length as separable

> At what point does it become reasonable to conclude that strncmp, and every other string API that treats the pointer to the string and its length as separable variables, are too dangerous to be used in security-sensitive software? In general I agree, we have a long way to go to writing more secure software by default. But this specific issue is different. The issue was not the string length was incorrect (the length passed to strncmp was the correct length for the response string); the problem here was a logic problem, which is harder to get right just by switching string implementations. The buggy code in question was basically (in an imaginary language with fully managed strings): if response is_a_prefix_of expected_hash: allow_login() when it should have been if response is_equal_to expected_hash: allow_login()

geofft 9y ago
Yeah, but if you are writing that pseudocode, it's obvious that is_a_prefix_of is the wrong operation. The problem is that strncmp is in fact a prefix-comparison function when used with n calculated one way, but also it's the "safer" version of strcmp when used with n calculated another way, and it's easy to confuse the two uses. In any other string implementation, you'd just use the most obviously-named compare function, there would be no need for a "safer" version of that function (there'd just be one reasonable comparison function), and it would do the right thing.
- jjnoakes 9y ago
  > also it's the "safer" version of strcmp when used with n calculated another way This isn't true; first off it isn't "safer" than strcmp() at all (this isn't strcpy vs strncpy after all), and second, no length argument to strncmp() will make it act like strcmp(). In order to get strcmp(), you have to also check the lengths are the same first. strlen(a) == strlen(b) && strncmp(a, b, strlen(either)) This is less safe than using strcmp() when you want equality (as this Intel issue shows) because it is easy to forget the length check. strcmp() does it implicitly for you. I agree the names are not ideal (in fact I write my own streq() and strpfx() routines because I think it reads easier and it is also easy to get the return value of strcmp() wrong), but again, that has nothing to do with separating the string's pointer and its length.
  - geofft 9y ago
    I agree with you, but please argue with the other person who objected to my comment saying that strncmp was obviously the safer version of strcmp. :-) An API where experienced users don't even agree what the function is supposed to be is a bad API.
    - jjnoakes 9y ago
      How do you know all parties involved in this discussion are experienced?

geofft 9y ago

Yeah, but if you are writing that pseudocode, it's obvious that is_a_prefix_of is the wrong operation. The problem is that strncmp is in fact a prefix-comparison function when used with n calculated one way, but also it's the "safer" version of strcmp when used with n calculated another way, and it's easy to confuse the two uses. In any other string implementation, you'd just use the most obviously-named compare function, there would be no need for a "safer" version of that function (there'd just be one reasonable comparison function), and it would do the right thing.

jjnoakes 9y ago
> also it's the "safer" version of strcmp when used with n calculated another way This isn't true; first off it isn't "safer" than strcmp() at all (this isn't strcpy vs strncpy after all), and second, no length argument to strncmp() will make it act like strcmp(). In order to get strcmp(), you have to also check the lengths are the same first. strlen(a) == strlen(b) && strncmp(a, b, strlen(either)) This is less safe than using strcmp() when you want equality (as this Intel issue shows) because it is easy to forget the length check. strcmp() does it implicitly for you. I agree the names are not ideal (in fact I write my own streq() and strpfx() routines because I think it reads easier and it is also easy to get the return value of strcmp() wrong), but again, that has nothing to do with separating the string's pointer and its length.
- geofft 9y ago
  I agree with you, but please argue with the other person who objected to my comment saying that strncmp was obviously the safer version of strcmp. :-) An API where experienced users don't even agree what the function is supposed to be is a bad API.
  - jjnoakes 9y ago
    How do you know all parties involved in this discussion are experienced?