[CC += Rusty]

Hi Joe,

> Date: 2026-11-14 18:03:44+0100
> From: Alejandro Colomar <alx+linux-hardening@kernel.org>
>
> Hi Joe,
> 
> > Date: 2026-11-14 07:28:23-0800
> > From: Joe Perches <joe@perches.com>
> >
> > On Sat, 2026-11-14 at 16:22 +0100, Alejandro Colomar wrote:
> > > As Bartosz reported, str_has_prefix() has a bug: it can't differentiate
> > > between an empty prefix matching an empty string from a non-matching
> > > prefix.  This is a fundamental design flaw in this API, and not
> > > something that can be fixed.
> > 
> > I still think this description is poor.
> > It's neither a bug nor a flaw.
> > It's a design choice.
> 
> As explained in more detail in the subthread, I think it is a bug.
> 
> If the function name were strprefix_len(), it would be a legitimate
> design choice, since 0 would indeed be the length of such a prefix, and
> it would be arguably useful to return 0 on a non-matching prefix.
> 
> But the function is named str_has_prefix().  Since an empty string is by
> convention (strstr(3), etc.) the prefix of every string, returning false
> is a bug.  Since the function returns 0 for such a case, it misbehaves.
> 
> Perhaps we can reach an agreement if I prepend this commit with one that
> renames all uses of str_has_prefix() to strprefix_len().  Then, I would
> agree to consider this as a design choice, and remove the text above.

Here's the list of categories from Rusty Russell:

	10. It's impossible to get wrong.
	9. The compiler/linker won't let you get it wrong.
	8. The compiler will warn if you get it wrong.
	7. The obvious use is (probably) the correct one.
	6. The name tells you how to use it.
	5. Do it right or it will always break at runtime.
	4. Follow common convention and you'll get it right.
	3. Read the documentation and you'll get it right.
	2. Read the implementation and you'll get it right.
	1. Read the correct mailing list thread and you'll get it right.

	-1. Read the mailing list thread and you'll get it wrong.
	-2. Read the implementation and you'll get it wrong.
	-3. Read the documentation and you'll get it wrong.
	-4. Follow common convention and you'll get it wrong.
	-5. Do it right and it will sometimes break at runtime.
	-6. The name tells you how not to use it.
	-7. The obvious use is wrong.
	-8. The compiler will warn if you get it right.
	-9. The compiler/linker won't let you get it right.
	-10. It's impossible to get right.

str_has_prefix() would get a -7, because the obvious use is wrong, or
perhaps a -6, because the name tells you how not to use it.

strprefix() is not perfect, but it's decent.  I'd say it can be a 3 at
least, if we document it as the following:

	This function determines whether the string pointed to by @s
	starts with the sequence of characters
	(excluding the terminating null character)
	in the string pointed to by @prefix.

	Returns:
	*  @s + strlen(@prefix) if @s starts with @prefix
	*  NULL if @s does not start with @prefix


Cheers,
Alex

-- 
<https://www.alejandro-colomar.es>