4 ms·

musl libc (an alternative libc) provides implementations of these functions that are memory-safe. (It only works on Linux though.)

saagarjha 7y ago
What functions does musl provide?
- winter_blue 7y ago
  It provides everything that libc does.
  - saagarjha 7y ago
    So how does it solve the issues with these functions?
    - winter_blue 7y ago
      It doesn’t — I was wrong. I was digging through its source code, and it turns out it isn’t memory-safe after all. Here’s the source code for stpcpy: https://github.com/ifduyue/musl/blob/master/src/string/stpcpy.c https://github.com/ifduyue/musl/blob/master/src/string/stpcp... If dest is too small in the function linked to above, musl’s stpcpy will happy cause a buffer overflow. Don’t know how or from where I got the impression that musl was a “safer” alternative to libc.
      - cyphar 7y ago
        The API of strcpy() is unsafe by design. The only way to make it safe is to not use it, and it's not musl's (nor glibc's) fault that this is the case. musl is interesting for a variety of other reasons, but being more memory safe isn't really one of them.
        _kst_ 7y ago
        strpy() is safe when used safely. That means that you've confirmed that the target is big enough. For example, there's no way this can fail: char s[10]; strcpy(s, "hello"); The problem is that it can also be used unsafely, and except in the simplest cases it's difficult or impossible to tell whether a give usage is safe. By contrast, gets() (which isn't even in the language anymore) is inherently unsafe, because you can't control what will appear on standard input.
morelisp 7y ago
Is is not possible to provide implementations of these functions which are both safe (meaning, within human ability to use correctly) and standards-compliant, as they either don't take any size or require leaving off the null terminator when the destination buffer is full.
anilakar 7y ago
Using musl as your standard library causes other problems, namely horrible Python performance and incompatibility with Valgrind.
- megous 7y ago
  What's slow in particular and on what arch?
  - anilakar 7y ago
    Alpine. Slow in particular? I don't have the resources to profile everything in our codebase and find the root issue, but others have already benchmarked it: https://superuser.com/questions/1219609/why-is-the-alpine-docker-image-over-50-slower-than-the-ubuntu-image https://superuser.com/questions/1219609/why-is-the-alpine-do...
- stonogo 7y ago
  musl is standards-compliant, so it sounds more like "using python or valgrind causes other problems,"
mhh__ 7y ago
If you have a critical need for memory safety then I think it's time to move on from C. I also have a (I guess?) Slightly unpopular opinion, that C is actually really ugly. Subjective, but C code is usually prone to repeating itself a lot or abstracting in an unsafe manner

saagarjha 7y ago

What functions does musl provide?

winter_blue 7y ago
It provides everything that libc does.
- saagarjha 7y ago
  So how does it solve the issues with these functions?
  - winter_blue 7y ago
    It doesn’t — I was wrong. I was digging through its source code, and it turns out it isn’t memory-safe after all. Here’s the source code for stpcpy: https://github.com/ifduyue/musl/blob/master/src/string/stpcpy.c https://github.com/ifduyue/musl/blob/master/src/string/stpcp... If dest is too small in the function linked to above, musl’s stpcpy will happy cause a buffer overflow. Don’t know how or from where I got the impression that musl was a “safer” alternative to libc.
    - cyphar 7y ago
      The API of strcpy() is unsafe by design. The only way to make it safe is to not use it, and it's not musl's (nor glibc's) fault that this is the case. musl is interesting for a variety of other reasons, but being more memory safe isn't really one of them.
      - _kst_ 7y ago
        strpy() is safe when used safely. That means that you've confirmed that the target is big enough. For example, there's no way this can fail: char s[10]; strcpy(s, "hello"); The problem is that it can also be used unsafely, and except in the simplest cases it's difficult or impossible to tell whether a give usage is safe. By contrast, gets() (which isn't even in the language anymore) is inherently unsafe, because you can't control what will appear on standard input.

morelisp 7y ago

Is is not possible to provide implementations of these functions which are both safe (meaning, within human ability to use correctly) and standards-compliant, as they either don't take any size or require leaving off the null terminator when the destination buffer is full.

anilakar 7y ago

Using musl as your standard library causes other problems, namely horrible Python performance and incompatibility with Valgrind.

megous 7y ago
What's slow in particular and on what arch?
- anilakar 7y ago
  Alpine. Slow in particular? I don't have the resources to profile everything in our codebase and find the root issue, but others have already benchmarked it: https://superuser.com/questions/1219609/why-is-the-alpine-docker-image-over-50-slower-than-the-ubuntu-image https://superuser.com/questions/1219609/why-is-the-alpine-do...
stonogo 7y ago
musl is standards-compliant, so it sounds more like "using python or valgrind causes other problems,"

mhh__ 7y ago

If you have a critical need for memory safety then I think it's time to move on from C. I also have a (I guess?) Slightly unpopular opinion, that C is actually really ugly. Subjective, but C code is usually prone to repeating itself a lot or abstracting in an unsafe manner