Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: iac594737:Fastmail
Date:   Wed, 14 Jun 2023 16:08:51 -0400
From:   Demi Marie Obenour <demi@invisiblethingslab.com>
To:     David Laight <David.Laight@aculab.com>,
        Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc:     Alexey Dobriyan <adobriyan@gmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Rasmus Villemoes <linux@rasmusvillemoes.dk>,
        Hans de Goede <hdegoede@redhat.com>,
        Mauro Carvalho Chehab <mchehab@kernel.org>,
        Sakari Ailus <sakari.ailus@linux.intel.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Juergen Gross <jgross@suse.com>,
        Stefano Stabellini <sstabellini@kernel.org>,
        Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
        Lee Jones <lee@kernel.org>, Andy Lutomirski <luto@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Vincenzo Frascino <vincenzo.frascino@arm.com>,
        Petr Mladek <pmladek@suse.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Sergey Senozhatsky <senozhatsky@chromium.org>
Subject: Re: [PATCH v3 0/4] Make sscanf() stricter
Message-ID: <ZIoeVjC6offUywop@itl-email>
References: <6ab6adce-2318-4ae6-bde6-4317485639fd@p183>
 <ZId/IA41c2sJyvE0@itl-email>
 <ZIeHfBf3aB3vUgRM@smile.fi.intel.com>
 <ZIeMyQXU49OcoxY2@itl-email>
 <ec3d7ebe62654e949329785bb32c3822@AcuMS.aculab.com>
 <ZIiMrDxI5Ts0s8fK@itl-email>
 <23df90dd35874fd89c64906e6a6de164@AcuMS.aculab.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="ndMq6uyPyBGNAYg2"
Content-Disposition: inline
In-Reply-To: <23df90dd35874fd89c64906e6a6de164@AcuMS.aculab.com>
Precedence: bulk


--ndMq6uyPyBGNAYg2
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Wed, 14 Jun 2023 16:08:51 -0400
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: David Laight <David.Laight@aculab.com>,
	Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Rasmus Villemoes <linux@rasmusvillemoes.dk>,
	Hans de Goede <hdegoede@redhat.com>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Sakari Ailus <sakari.ailus@linux.intel.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Juergen Gross <jgross@suse.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
	Lee Jones <lee@kernel.org>, Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Vincenzo Frascino <vincenzo.frascino@arm.com>,
	Petr Mladek <pmladek@suse.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	Sergey Senozhatsky <senozhatsky@chromium.org>
Subject: Re: [PATCH v3 0/4] Make sscanf() stricter

On Wed, Jun 14, 2023 at 08:23:56AM +0000, David Laight wrote:
> From: Demi Marie Obenour
> > Sent: 13 June 2023 16:35
> >=20
> > On Tue, Jun 13, 2023 at 01:02:59PM +0000, David Laight wrote:
> > > From: Demi Marie Obenour
> > > > Sent: 12 June 2023 22:23
> > > ....
> > > > sscanf(), except to the extent that -Werror=3Dformat can keep worki=
ng.
> > > > Userspace sscanf() is almost useless: it has undefined behavior on
> > > > integer overflow and swallows spaces that should usually be rejecte=
d.
> > >
> > > scanf() is designed for parsing space separated data.
> > > Eating spaces it part of its job description.
> > >
> > > 	David
> >=20
> > In this case I would prefer to have two versions: one that eats spaces
> > and one that does not.  For instance, I don=E2=80=99t think any user of
> > xenbus_scanf() wants the space-swallowing behavior.  This can be worked
> > around in xenbus_scanf(), of course, by having it reject strings with
> > spaces (as determened by isspace()) before calling vsscanf().
>=20
> What sort of formats and data are being used?

Base-10 or base-16 integers, with whitespace never being valid.

> The "%s" format terminates on whitespace.
> Even stroul() (and friends) will skip leading whitespace.

Yes, which is a reason that strto*l() are just broken IMO.  I=E2=80=99m try=
ing
to replace their uses in Xen with custom parsing code.
--=20
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

--ndMq6uyPyBGNAYg2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmSKHlUACgkQsoi1X/+c
IsH3hw/5AehDaQcd7rD6jShESUA3CUBLSvI0dX8Wy+PtdBvL2K7YiJmByokguiXU
+4Shj1aNGvptBv5wHSpEC1ZVm8nyYAh70tnZlftkUJ0fUqJqMYug1by6zQVkXJ+P
dKjOpfVPnXYTrS/TuNyBL/COeeVYLGpfG2iLWce5JBAlXP7aERINUjEqpfuiuQ/l
tj1mBx8vxaiPa2cVtH8GzdE6aoOm9NKM2UKzIIEq5J+TfFw4efxWm4hAVAGMV3lA
xEJ5h97p6RNQ3UufZ1GyaCVN+2L9U/Q1cGxLvzYSX11K5wPfg3VmZU3UTmBat7Co
KmMra4aWTTjVliCxcIdTOO/xFPA1SWDgLTKg7ExmUbbbmFqjsXg52EevmoWHPR8b
YHxeFiX0TN7t9u4FvEq4Ic5Rzv69o0N7001THIYUfge46lQ76h1GdCR6LBpBBVoq
i3l+Max8LLMcw1HqyyxxLWeEiDy/aFIAsfktnWXVZkTBEoZgfO9+ncmq0ZE0/rwJ
4HKCgmasGM+ofuFsOdG3/v8Ra18nTYfSJRCvBtch5/V3SSbklhdsMBYBOgaZPzuM
N8ibN/bdvlxE4ia/qlu090z3+4AGuw0ZdHe2FDSFuqFB2YupWD7iaBrOvK4tYajs
FaDnqyw6ApMBYN+6lJj+mb8dBnD+k00paoIi8BG+KRbywL/X40w=
=zzor
-----END PGP SIGNATURE-----

--ndMq6uyPyBGNAYg2--