Re: [PATCH 03/10] scsi: NCR5380: Replace snprintf() with the safer scnprintf() variant

Lee Jones
2024-02-20T08:24:50Z

On Mon, 19 Feb 2024, Kees Cook wrote:

> On Mon, Feb 19, 2024 at 03:23:12PM +0000, Lee Jones wrote:
> > Adding this to checkpatch is a good idea.
>
> Yeah, please do. You can look at the "strncpy -> strscpy" check that is
> already in there for an example.
>
> >
> > What if we also take Kees's suggestion and hit all of these found in
> > SCSI in one patch to keep the churn down to a minimum?
>
> We don't have to focus on SCSI even. At the end of the next -rc1, I can

When I've conducted similar work before, I've taken it subsystem by
subsystem. However, if you're happy to co-ordinate with the big penguin
et al. and get them all with a treewide patch, please go for it.

> send a tree-wide patch (from Coccinelle) that'll convert all snprintf()
> uses that don't check a return value into scnprintf(). For example,
> this seems to do the trick:
>
> @scnprintf depends on !(file in "tools") && !(file in "samples")@
> @@
>
> -snprintf
> +scnprintf
> (...);
>
>
> Results in:
>
> 2252 files changed, 4795 insertions(+), 4795 deletions(-)

Super!

--
Lee Jones [李琼斯]