22 ms·
Banned C standard library functions in Git source code
- jepler 7y agoI guess they care too much about portability to use "pragma GCC poison"?
- zsrxx 7y agoWanting code to compile on something other than gcc is not "caring too much", it's being responsible
- The_rationalist 7y agoResponsible? What an hyperbolic statement. Could you enlighten me on what would be the significant negative consequences? I hope that your mental equation take into account the missed usefulness of GCC only attributes, flags and extensions by being clang compatible.
- zsrxx 7y agoI don't know what to tell you. Do you think all compilers should implement all GCC proprietary extensions, basically creating a parallel C standard? And that's not saying that GCC extensions are not useful, but they should not be considered the norm
- klez 7y agoAgreed. But I wonder if we already have a sort of parallel C standard already with POSIX (of course the parts about C, not about OS facilities).
- adrianN 7y agoFor this particular case it wouldn't be a big deal. The code is still valid C, it's just that GCC makes sure that you don't use the poisoned values.
- MaxBarraclough 7y agoTo rephrase adrianN's comment: It wouldn't mean breaking things on compilers other than GCC. It would simply add compile-time checks when building with GCC, and would do nothing on other compilers.
- kbumsik 7y agoBecause of possible string buffer overflow?
- opticfluorine 7y agoYes, and interestingly, because even when used correctly they "complicate audits". This is an interesting use of preprocessor macros, I'm strongly debating introducing something like this at work.
- kbumsik 7y agoI'm not an expert in C, but then what's the issue with strncpy() or any "n" functions? It prevents overflow AFAIK. Also what is the alternative (memcpy?) and why?
- susam 7y agostrncpy() does not guarantee that the copied string would be terminated with a null byte ('\0'). For a call that looks like strncpy(dst, src, n), if there is no null byte in the first n bytes of src, the string copied to dst would also not contain a null byte. Here is an example code to demonstrate the problem: #include <stdio.h> #include <string.h> int main() { char a[] = "01234567"; strncpy(a, "foobar", 4); printf("%.8s\n", a); return 0; } Here is the output: $ cc -std=c89 -Wall -Wextra -pedantic foo.c && ./a.out foob4567 A C89-conforming alternative I use is a macro like this that guarantees '\0'-termination as the first thing: #define strcp(a, b, c) (a[0] = '\0', strncat(a, b, c - 1)) An example from my code: https://github.com/susam/uncap/blob/master/uncap.c#L78-L87 https://github.com/susam/uncap/blob/master/uncap.c#L78-L87 Here is how to use it: #include <stdio.h> #include <string.h> #define strcp(a, b, c) (a[0] = '\0', strncat(a, b, c - 1)) int main() { char a[] = "01234567"; strcp(a, "foobar", 4); printf("%.8s\n", a); return 0; } Here is the output: $ cc -std=c89 -Wall -Wextra -pedantic foo.c && ./a.out foo
- saagarjha 7y agoYour macro refers to a twice; it might be better as a function.
- MuffinFlavored 7y agoFor anybody else: Why is strncpy insecure? https://stackoverflow.com/questions/869883/why-is-strncpy-insecure https://stackoverflow.com/questions/869883/why-is-strncpy-in... > strncpy() doesn't require NUL termination, and is therefore susceptible to a variety of exploits.
- wruza 7y agoIt also fills all remaining bytes (if any) with nuls. ‘N’ in its name is not the same ‘n’ as in snprintf etc. It could be named fldcpy, as it works with 0-padded fixed-width fields rather than 0-terminated strings.
- vagab0nd 7y agoYes. Also as mentioned in the post, strlcpy (when it's available) is safer.
- jandrese 7y agoBut still not safe, thanks to the return value. Imagine the case where you are using strlcpy because you can't be sure if the source buffer is properly null terminated.
- dezgeg 7y agoIf your buffer isn't a NUL-terminated, then don't call a function that is only defined for NUL-terminated buffers. It's as simple as that. I'm baffled by how some people claim strlcpy() is 'broken' or 'not safe' because it doesn't handle non-NUL-terminated inputs; the exact same thing applies to just about any function in the C standard library that takes strings as input. Are functions like strchr(), fopen(), printf(), strstr(), setenv() 'broken' as well?
- jandrese 7y agoYes, because cutting off the trailing NULL is a threat vector every C programmer needs to be conscious of whenever they're dealing with strings. But it's also a problem because maybe the programmer is using strlcpy to grab the first five lines of a 10TB memory mapped file. If you're not thinking about the implications of that return value it can be a real surprise.
- slovenlyrobot 7y agoThat's a surprisingly small list, missing e.g. sscanf / gets / strtok / all the other "usual suspects" at least
- ianai 7y agoI hope it grows through community effort. This is a good sanity check sort of thing.
- deleted 7y ago[deleted]
- Kaveren 7y agoMaybe gets doesn't need to be banned because it got removed in C11 and at least gcc issues a warning on use.
- asveikau 7y agoI don't see a huge problem with strtok as long as it isn't a multi threaded program. It is not in gets territory which is literally impossible to use correctly.
- slovenlyrobot 7y agoI can't remember what's wrong with it, but it's responsible for about eleventy billion CVEs over the years
- lholden 7y ago"I don't see a huge problem with insert thing here as long as it isn't a multi threaded program." Usually a bad omen. :)
- bhk 7y agoSynchronous reentry is a problem. Say some loop using strtok calls a function... how do you know that that function doesn't use strtok (or call another function that does...). Any use of non-const static variables in general has this problem, and strtok is just one example.
- stiff 7y agoLooks like Git has its own string type: https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.c https://github.com/git/git/blob/master/strbuf.c See this for the story of why strncpy/strncat are insecure: https://en.wikipedia.org/wiki/C_string_handling#Replacements https://en.wikipedia.org/wiki/C_string_handling#Replacements
- adamnemecek 7y agoLike essentially all C programs.
- zsrxx 7y agoWhat's a good library for this kind of boilerplate? A lightweight one if possible, i.e. not fucking glib
- tlb 7y agoThere are far too many. APR is a solid choice -- very portable, well-tested, and fast. It uses memory pools a lot, which work well for many styles but not everything. See https://apr.apache.org/docs/apr/1.7/modules.html https://apr.apache.org/docs/apr/1.7/modules.html
- adamnemecek 7y agoRust. Half-joking.
- vmsp 7y agoSalvatore Sanfilippo, from Redis fame, has a nice one https://github.com/antirez/sds https://github.com/antirez/sds.
- zsrxx 7y agoI haven't looked much so I can't comment on the quality of the library but that hairdo is glorious. Props to Salvatore!
- dblock 7y agoWindows programmers are familiar with StrSafe.h, https://en.wikipedia.org/wiki/Strsafe.h https://en.wikipedia.org/wiki/Strsafe.h and https://github.com/dotnet/coreclr/blob/master/src/pal/inc/strsafe.h https://github.com/dotnet/coreclr/blob/master/src/pal/inc/st... which go a lot further. Also found https://github.com/mubix/netview/blob/master/banned.h https://github.com/mubix/netview/blob/master/banned.h on Github with a better list.
- WalterGR 7y agoIIRC, StrSafe.h - and much more - came from the development of the Microsoft Security Development Lifecycle (SDL). Code Red was the wake-up call for Microsoft and in February 2002, based on a memo from Bill Gates that first coined the phrase "Trustworthy Computing," Microsoft shutdown Windows development for the first time ever to get a handle on the security issues the products were facing. https://www.itprotoday.com/strategy/story-behind-microsoft-security-development-lifecycle https://www.itprotoday.com/strategy/story-behind-microsoft-s...
- pjmlp 7y agoAdditionally we get to enjoy bounds checked arrays(std::...), and iterators on debug builds, with possibility to selectively enable them in release mode. While Windows by all means still has its security issues, the toolchain is much more security oriented than most FOSS alternatives thanks to the Windows XP wake up call. Android and ChromeOS are probably the mostly locked down alternatives on the FOSS space.
- uncletaco 7y agoTangential but the fact that I had to open up the machine and remove a screw to completely replace ChromeOS with linux bothers the fuck out of me.
- pjmlp 7y agoWell, you can see how they are locking it down with containers sandboxing from an IO talk, by making use of gVisor and a Rust based containers. "Linux for Chromebooks: Secure Development" https://www.youtube.com/watch?v=pRlh8LX4kQI https://www.youtube.com/watch?v=pRlh8LX4kQI
- noname120 7y agoWhy is there no brief explanations in this code why each function is banned?
- arcturus17 7y agoRead the manual!
- wyldfire 7y agoCollectively "because they're too easy to misuse (and even if used correctly, complicate audits)."
- kevin_thibedeau 7y agoNone are properly length checked. strncpy() is for "binary" strings and can omit the NUL in addition to excessive zero padding large buffers.
- calibas 7y agoI believe they're all vulnerable to overflows and easy to exploit. https://pointerless.wordpress.com/2012/02/26/strcpy-security-exploit-how-to-easily-buffer-overflow/ https://pointerless.wordpress.com/2012/02/26/strcpy-security...
- saagarjha 7y ago> As many already know, strcpy(3) is a very unsafe function call in the C library (you should always use strncpy(3) unless you can be exactly certain about the number of bytes you’re going to copy beforehand). strncpy pretends to be safe but fails to NULL-terminate and has other performance issues that generally lead me to believe it’s a security placebo. I would recommend using snprintf instead.
- asveikau 7y agoA C programmer reading this list knows exactly why they are there. It is not at all a controversial list. Edit: I guess some down voter doesn't believe me but it continues to be true. They are all string functions. Most of them do not take an output buffer size, so a source string exceeding the destination buffer will overflow. Others, like strncpy, take an output buffer size but will not null terminate when exceeded, so the buffer size must be reduced by 1 by the caller and potentially manually terminates, which is too easy to not consider. But any C programmer with significant experience already knows these pitfalls. So it's not controversial.
- alister 7y agoI'm glad to see that setjmp() and longjmp() are still allowed. I'm just kidding by the way. For those C programmers who haven't encountered these before, it is a powerful way to do a "goto" in C. Powerful in the sense that you can jump anywhere, not limited to the same function. If it's used at all these days, it's used for exception handling. More info: https://en.wikipedia.org/wiki/Setjmp.h https://en.wikipedia.org/wiki/Setjmp.h
- saagarjha 7y agoI see zero use of those in the codebase, so perhaps they should be banned too. Or maybe they’re not on this list because nobody was using them already?
- susam 7y agoI have worked in large code bases (RSA NetWitness, Oracle Database, etc.) where setjmp/longjmp were used to create macros for exception handling using TRY-CATCH-ENDTRY blocks in C.
- saagarjha 7y agoPersonally, I feel like wrapping exception handlers in macros makes it easy for people to do unsafe things with it like dynamically allocating memory or calling system functions that can’t handle it correctly.
- LukeShu 7y agoThe way I see the list is that it isn't meant to be exhaustive, it's meant to be functions that contributors are likely to try to use. A new contributor might not realize that they should be using Git's internal strbuf.h instead of the libc string functions. It's a way to give them feedback on that from their compiler, before they spend more time on the patch and send it to the mailing list.
- rkagerer 7y agoMight be nice if the error messages suggested such alternatives instead of just saying "banned"?
- jcl 7y agoLooks like the second vsprintf definition should be "BANNED(vsprintf)", not "BANNED(sprintf)". Not that it matters much, as it only affects the error message.
- gus_massa 7y agoNice catch! You can send a "PR", but note that they have their own custom "PR" procedure, not the standard "PR" procedure in GitHub. > Git Source Code Mirror - This is a publish-only repository and all pull requests are ignored. Please follow https://github.com/git/git/blob/master/Documentation/SubmittingPatches https://github.com/git/git/blob/master/Documentation/Submitt... procedure for any of your improvements.
- LukeShu 7y agoTheir "custom" procedure is the `git send-email` command, which has a lot more of a claim to be "standard" than GitHub's custom procedure.
- saagarjha 7y agoAside: GitHub’s refusal to provide a feature to close pull requests for mirrors is utterly ridiculous since it requires that people (or bots) go around and disable pull requests and point people to the patch submission process.
- OJFord 7y agoWhat's weirdest to me is that it differs from the policy on Issues, which can be turned off in settings. I sort of get not allowing it, except that it's inconsistent.
- yjftsjthsd-h 7y ago> not the standard "PR" procedure in GitHub If it is specific to one implementation, then it is not standard, pretty much by definition.
- 7y ago
- saagarjha 7y agoWhat does Git use instead for copying strings? snprintf? Edit: also interesting is a search for alloca: https://github.com/git/git/search?utf8=&q=alloca&type= https://github.com/git/git/search?utf8=&q=alloca&type=
- LukeShu 7y agoGit has an internal "strbuf" library https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.h
- masklinn 7y agoAlternatively it also uses snprintf, though as a small internal variant (xsnprintf) which literally kills the program if the destination buffer is too small: https://github.com/git/git/blob/master/wrapper.c#L636-L650 https://github.com/git/git/blob/master/wrapper.c#L636-L650
- winter_blue 7y agomusl libc (an alternative libc) provides implementations of these functions that are memory-safe. (It only works on Linux though.)
- saagarjha 7y agoWhat functions does musl provide?
- winter_blue 7y agoIt provides everything that libc does.
- saagarjha 7y agoSo how does it solve the issues with these functions?
- winter_blue 7y agoIt doesn’t — I was wrong. I was digging through its source code, and it turns out it isn’t memory-safe after all. Here’s the source code for stpcpy: https://github.com/ifduyue/musl/blob/master/src/string/stpcpy.c https://github.com/ifduyue/musl/blob/master/src/string/stpcp... If dest is too small in the function linked to above, musl’s stpcpy will happy cause a buffer overflow. Don’t know how or from where I got the impression that musl was a “safer” alternative to libc.
- Koshkin 7y ago> strcpy ... BANNED But they cannot ban while (* p++ = * q++); now can they.
- LukeShu 7y agoIt's not meant to be a substitute for humans reviewing patches. It's just meant to catch things new contributors are likely to try to use, and give them feedback on it before they send the patch to the mailing list.
- rat9988 7y agoTruly curious as I don't code in C, or any other low level language. What is the problem with it? That there might not be enough memory allocated at *q?
- zsrxx 7y agoIt doesn't stop until *p is \0, so yes
- microtherion 7y agoNot enough memory at *p. The loop performs the exact same function that strcpy does, and some people just write it out by hand.
- Koshkin 7y agoK&R is turning in its grave.
- kgwgk 7y agoYou made me check that K is still alive!
- basementcat 7y agoKoshkin wrote K&R and not K|R.
- b55c63a4 7y agoFor context, this header file was introduced during the period of Microsoft's acquisition of GitHub. Git's banned.h roughly approximates the banned functions according to Microsoft's Security Development Lifecycle: https://docs.microsoft.com/en-us/previous-versions/bb288454(v=msdn.10) https://docs.microsoft.com/en-us/previous-versions/bb288454(... It seems Microsoft once published their own banned.h, but this file is not readily available from the MSDN anymore.
- brianpgordon 7y agoWhat are you saying is the connection between GitHub's acquisition and this header? This code is from git, not GitHub.
- OJFord 7y agoI'm also confused reading that comment, but I suppose the intended link is that GitHub employees are significant git contributors?
- philwelch 7y agoYes, I've seen other instances of Microsoft/GitHub making substantial Git contributions: https://devblogs.microsoft.com/devops/supercharging-the-git-commit-graph-iii-generations/ https://devblogs.microsoft.com/devops/supercharging-the-git-... Microsoft seemed to have been adopting Git already, so it may be that acquiring Github was merely part of a broader Git strategy that Microsoft has adopted.
- clX111 7y agoThere are persons working on git who abuse strcpy()? This sounds a bit like activism and not based on reality.
- ____Sash---701_ 7y ago#ifndef BANNED_H #define BANNED_H /* * This header lists functions that have been banned from our code base, * because they're too easy to misuse (and even if used correctly, * complicate audits). Including this header turns them into compile-time * errors. / #define BANNED(func) sorry_##func##_is_a_banned_function #undef strcpy #define strcpy(x,y) BANNED(strcpy) #undef strcat #define strcat(x,y) BANNED(strcat) #undef strncpy #define strncpy(x,y,n) BANNED(strncpy) #undef strncat #define strncat(x,y,n) BANNED(strncat) #undef sprintf #undef vsprintf #ifdef HAVE_VARIADIC_MACROS #define sprintf(...) BANNED(sprintf) #define vsprintf(...) BANNED(vsprintf) #else #define sprintf(buf,fmt,arg) BANNED(sprintf) #define vsprintf(buf,fmt,arg) BANNED(sprintf) #endif #endif / BANNED_H */
- kazinator 7y agoIf that header is ever accidentally included before any standard header, it's undefined behavior. :)
- anfilt 7y agoHow? The preprocessor is ran before every thing else? It will overwrite the defintions in the header just like in the source file? You still would get a linking error. The only reason I couldn think is if the the stdlib headers also called undef for those functions. Moreover this is all during build not runtime.
- nybble41 7y agoAccording to C99, section 7.1.3: If the program declares or defines an identifier in a context in which it is reserved (other than as allowed by 7.1.4), or defines a reserved identifier as a macro name, the behavior is undefined. It doesn't matter what the macro would expand to; simply defining the reserved identifier as a macro triggers undefined behavior. That doesn't mean it won't work, for some specific combination of standard headers, compiler, and program source code. It just isn't a strictly conforming program. A conforming implementation is allowed to flag this as an error, ignore the definition, or simply generate nonsense output.
- miyeahu 7y agoHuh, I literally just read through this file a few minutes before this was posted because I was randomly browsing the git source code.
- westurner 7y agoFWIW, here's awesome-static-analysis > Programming Languages > C/C++: https://github.com/mre/awesome-static-analysis/blob/master/README.md#cc https://github.com/mre/awesome-static-analysis/blob/master/R... These tools have lists of functions not to use. Most of them — at least the security-focused ones — likely also include: strcpy, strcat, strncpy, strncat, sprints, and vsprintf just like banned.h
- whydoyoucare 7y agoIt is also important to teach newbies on the pitfalls of certain libc functions. Too much spoon feeding creates a bigger mess in the long run.
- badrabbit 7y agoPuts(),gets() would make a good addition?
- zzo38computer 7y agoI think gets() especially should never be used (but puts() is OK), but I think strcpy() and all of the other stuff they mention there is actually OK to use if you are careful.
- hawski 7y agoWhat's wrong with puts? GCC for example will even change a naive printf to puts when applicable.
- badrabbit 7y agoYou're right about puts. I guess I am just used to avoiding both.
- imrehg 7y agoInteresting to see the starting commit for that file, there's quite a bit of discussion and rationale too: https://github.com/git/git/commit/c8af66ab8ad7cd78557f0f9f5ef6a52fd46ee6dd https://github.com/git/git/commit/c8af66ab8ad7cd78557f0f9f5e...
- peff 7y agoI see a lot of comments to the effect of "shouldn't XYZ also be banned". The answer is that we're not necessarily trying to be exhaustive. The point is to flag common errors before we even hit review, so we add new functions mostly when somebody tries to misuse them. I don't recall anybody trying to abuse longjmp() in Git's codebase yet (and no, that's not a challenge).
- Cogito 7y agoPeff, for the people asking in the thread, is there a place where correct alternatives are suggested or demonstrated? I know there are a few different places that talk about how to use git's internal machinery, but not sure if any are specific to these banned functions.
- masklinn 7y agoThe original commits mentions git's strbuf API[0] and its xsnprintf, a variant of snprintf which asserts that the destination buffer was big enough[1] (rather than just return truncation information). For other codebases, snprintf is the usual recommendation, and careful straight buffer manipulation (mem*) iff performances are a concern. [0] https://schacon.github.io/git/technical/api-strbuf.html https://schacon.github.io/git/technical/api-strbuf.html [1] https://code.forksand.com/linux/git_git/commit/7b03c89ebd10396ac7569f0c8c4fa0b4efd4f7ed https://code.forksand.com/linux/git_git/commit/7b03c89ebd103...
- peff 7y agoThe commit messages that add them to banned.h discuss alternatives, though most of the explanations are Git-specific and assume you'll look elsewhere to figure out how to actually use those alternatives.
- userbinator 7y agoGood to see the list is short and relatively sane compared to other "banned function" lists. Unfortunately, "too easy to misuse" is a slippery slope, and gets(), which is probably the best example of a function which is really broken by design, isn't on that list. I'm surprised that "complicate audits" is given as a reason, because isn't this something static analysers (and I mean ones that actually analyse data/code flow, not dumb pattern-matchers) can easily detect? It's really just asking the question "how long is this/can this be" and following the data back to its origin(s).
- rkangel 7y agoC aliasing rules can very quickly make "following the data back to its origin" very difficult.
- userbinator 7y agoTheoretically it's equivalent to the Halting Problem, but in practice I've not seen such difficulty; if aliasing does become a problem to the extent that following dataflow is difficult, I suspect there are already far deeper design flaws in the codebase.
- pjmlp 7y agoAs per ISO C11 standard, compliant compilers no longer need to support gets().
- jasonhansel 7y agoIf I had time, I'd make a library (perhaps musl-based?) that implements "libc but without all the parts you're not actually supposed to use."
- Gibbon1 7y agoThat make me wonder how hard it would be to just strip the bad functions out of the library.
- anfilt 7y agoWell your std c library is generally just a collection of .o, .a, .lib files. So you could use gnu bin tools to remove symbols of your choosing. However good luck getting your system to build software because that would modify the stdlib for all things compiled on your system. You could also tell gcc or clang not to link to the std library and providr your own with just a few switches on invocation of the compiler
- Gibbon1 7y agoOther thought would be to put the dlls with unsafe functions in different location than the safer ones and throw up a warning when an application loads them.
- bakpakin 7y agoCheckout libk https://c.hale.su/lexi/libk/home https://c.hale.su/lexi/libk/home
- forrestthewoods 7y agoNeat macro. I like the idea. Suggestion: the macro should recommend a replacement. “Sorry_sprintf_is_banned__use_FOO_instead”.
- tails4e 7y agoDelighted to see strncat there, it's a buffer overflow waiting to happen, especially as the name sounds like it's the 'safer version' where it takes a size argument, except it's not the size of the destination buffer, it's the remaining size, so unless you know this, it's wrong for every non empty buffer. strlcat (not standard) operates how you expect.
- WalterBright 7y agoWhenever I review code and see strncat there, it's almost guaranteed to be a bug. This is for the simple reason that nobody remembers exactly what strncat does, and so misuse it.
- codedokode 7y agoWhat surprises me in C developers is that C exists for probably 40 years but they still don't have proper strings (not just pointers). In many cases there is no large performance penalty for storing string length, and checking it, but they still use pointers or a separate pair of variables for pointer and buffer size instead of single object.
- zxcvbn4038 7y agoThere are countless libraries that add higher level string functions and no end to higher level languages. C fills the niche where you want something higher level then assembly but lower level then Perl, ruby, python, etc. Sometimes you want or need to manage your own memory. Arduino is a good contemporary example.
- stjohnswarts 7y agoExactly. C philosophy is to use libraries and not put things like a better string library in the core functions of the language. It keeps the language relatively clean and easy to understand, unlike c++
- unscaled 7y agoSo the C philosophy is to provide a bad standard string library that is not thread-safe and makes it impossible to write programs without remote code execution vulnerabilities, rather than have a better library with exactly the same functionality but with more security and safety "bloat"? /snark Yes, C used have a cavalier approach towards security in the past. But if you're asking why the standard library is not fixed yet, I think that instead of pinning it to some lofty philosophy, it's safer to say that good C developers realized long ago that the original C strings are a mistake. Most big C projects define their own string functions and often their own length-prefixed string types. The C standard committee just gave up on fixing this issue in the standard library, but this is not due to philosophy, but because of the impracticality to force a standard solution on this stage.
- deleted 7y ago
- SopaDeMacaco 7y agoBunch of cucks who need to gimp themselves, just because they don't feel responsible enough to use a tool.
- bigtrakzapzap 7y agoThese shouldn't be used either (_s are available in C11, _l tend to be locale-parameter thread-safety, and _r have sizes/state for bounds/thread-safety): - strtok -> strtok_r / strtok_s - asctime -> strtok_r / strtok_s - gmtime -> gmtime_r / gmtime_s - localtime -> localtime_r / localtime_s - ctime -> ctime_r / ctime_s - dirname -> dirname_r - basename -> basename_r - devname -> devname_r - readdir -> readdir_r - ttyname -> ttyname_r - gamma -> gamma_r - lgamma -> lgamma_r - lgammaf -> lgammaf_r - lgammal -> lgammal_r - atoi -> atoi_l - atof -> atof_l - atol -> atol_l - atoll -> atoll_l - gets -> gets_s - scanf -> scanf_l / scanf_s - fscanf -> fscanf_l / fscanf_s - sscanf -> sscanf_l / sscanf_s - tmpfile -> tmpfile_s - fopen -> fopen_s - getenv -> getenv_s - strdup -> strndup - strcmp -> strncmp - strlen -> strnlen - (Multibyte/wide conversion functions without mbstate_t parameter) - wcslen / wscnlen -> wcsnlen_s - wcsncasecmp / wcscasecmp_l / wcsncasecmp -> wcsncasecmp_l - strcasecmp / strcasecmp_l / strncasecmp -> strncasecmp_l - bzero (use explicit_bzero, in some cases) - calloc, realloc -> reallocarray (for arrays of non-byte items) - memmove -> memmove_s - strncat -> strncat_s - strncpy -> strncpy_s - srand / rand -> rand_r There are others that are platform-specific. Thread-safety, internal mutable state (not thread-safe), and buffer-overflows are the primary concerns that aren't necessarily applicable in all situations.
- masklinn 7y agoAnnex K was never very popular, is still very easy to misuse[0] and has pretty much been deprecated and slated for removal. [0] http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm#mistakes http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm#mi...
- damien_brooklyn 7y agoBack in my individual contributor days I got into serious trouble because of this. Where can I find it has officially been deprecated? I tried and I can still use it without getting any warnings?
- fserb 7y agoThis file could be made much better by having comments pointing to reasonable alternatives to the banned functions.