Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail From: Keith Thompson Newsgroups: comp.lang.c,comp.programming Subject: Re: C is not a low level language Followup-To: comp.lang.c Date: Sun, 24 Feb 2019 12:53:30 -0800 Organization: None to speak of Lines: 24 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: reader02.eternal-september.org; posting-host="d0da4294d431f134195cc12f06010206"; logging-data="22487"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+B58T10S/Hzik3ya1fzUFN" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux) Cancel-Lock: sha1:8ZxOfKaPSxpJ+rcLz67pwHe2NbA= sha1:ecfTKS2wdMNKB9RZIVLtHUAGcuo= Xref: csiph.com comp.lang.c:141250 comp.programming:9665 Martin Gregorie writes: [...] > There are (relatively) simple ways to write secure code, such as always > using the 'strn...' functions rather than the older 'str...' equivalents > and *taking the trouble to size storage correctly* that make code a lot > more bullet-proof. Its shameful that so many coders don't use them and/or > don't test their code adequately. No, the strn* functions are not drop-in safer replacements for the str* functions. I've discussed strncpy() here (in comp.lang.c) before, but for those of you following the inappropriate mass cross-posting of this discussion, here's what I wrote about it: http://the-flat-trantor-society.blogspot.com/2012/03/no-strncpy-is-not-safer-strcpy.html I've directed followups to comp.lang.c only. (My newsreader or server won't even let me cross-post to this many newsgroups.) -- Keith Thompson (The_Other_Keith) kst-u@mib.org Will write code for food. void Void(void) { Void(); } /* The recursive call of the void */