bug-gnulib@gnu.org mirror (unofficial)
 help / color / mirror / Atom feed
From: Paul Eggert <eggert@cs.ucla.edu>
To: Bruno Haible <bruno@clisp.org>, bug-gnulib@gnu.org
Subject: Re: [PATCH 1/4] localename: -Wtautological-pointer-compare
Date: Fri, 13 Jan 2023 15:36:55 -0800	[thread overview]
Message-ID: <b2acc230-4e88-cc46-d08f-366a7affc211@cs.ucla.edu> (raw)
In-Reply-To: <17910367.MNNF8PUAaN@nimes>

On 2023-01-13 14:59, Bruno Haible wrote:
> Replacing a function that starts with an entry check — which is a good
> practice [1]

It's a good practice in some contexts, bad in others.

In this particular case, on practical Gnulib targets the input should be 
checked anyway, both statically by the compiler at the call point and 
dynamically by the MMU.

There is a downside of the extra runtime check, in that if static 
checking is disabled (a mistake if you ask me, but many people do it), 
then the calling code won't immediately crash like it should. Instead, 
the function simply sets errno and returns, and the calling code might 
go on to do the wrong thing because there's a lot of sloppy calling code 
that either doesn't check errno or that has never been tested to do the 
right thing when the function fails.

So my guess is that for this particular case on practical hosts, the 
additional runtime check is more likely to introduce a security bug, 
than to prevent one. Of course this is just a guess. But that's why I 
wrote the patch the way I did.

  reply	other threads:[~2023-01-13 23:37 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-13 20:17 [PATCH 1/4] localename: -Wtautological-pointer-compare Paul Eggert
2023-01-13 20:17 ` [PATCH 2/4] Don’t use alloc_size with xlclang 16.1 Paul Eggert
2023-01-13 20:17 ` [PATCH 3/4] assert-h: fix configure comment-out Paul Eggert
2023-01-13 20:17 ` [PATCH 4/4] assert-h: suppress xlclang 16.1 false alarms Paul Eggert
2023-01-13 22:59 ` [PATCH 1/4] localename: -Wtautological-pointer-compare Bruno Haible
2023-01-13 23:36   ` Paul Eggert [this message]
2023-01-14 11:00     ` Bruno Haible
2023-01-15  3:02       ` Paul Eggert
2023-01-15 22:03         ` Bruno Haible
2023-01-16  0:15           ` Paul Eggert

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

  List information: https://lists.gnu.org/mailman/listinfo/bug-gnulib

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b2acc230-4e88-cc46-d08f-366a7affc211@cs.ucla.edu \
    --to=eggert@cs.ucla.edu \
    --cc=bruno@clisp.org \
    --cc=bug-gnulib@gnu.org \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).