Re: [PATCH] sscanf.3: Remove term 'deprecated', and expand BUGS

[Matthew House <mattlloydhouse@gmail.com>]

On Wed, Dec 6, 2023 at 3:18 PM Alejandro Colomar <alx@kernel.org> wrote:
> Hi Matthew,
>
> On Wed, Dec 06, 2023 at 01:33:50PM -0500, Matthew House wrote:
> > I feel like this is rather overstating the difficulty. In practice, the
> > no-conversion condition is very commonly detected by checking whether
> > *endptr == nptr after the call. The usual idiom I see is something like:
> >
> >     char *end;
> >     errno = 0;
> >     value = strtol(ptr, &end, 10);
> >     if (end == ptr || *end != '\0' || errno == ERANGE)
>
> That test could trigger UB, if you passed an unsupported base.  Of
> course, in this case you pass 10, but what if the base was a
> user-controlled variable?  In such a case, nothing says what happens to
> 'end' (experimentally, I see it is not modified, so it would be left
> uninitialized); so dereferencing it, or even comparing it, would be UB.
>
> >         goto err;
>
> Yeah, if you just don't care and want to handle all errors in the same
> way, and you know the base is supported, this is correct.

The practical answer is that the base is never ultimately a user-controlled
variable. Sometimes people define wrapper functions with a variable base,
but that base is still ultimately fixed by all its callers. If you disagree
with this, I challenge you to name a single example.

The theoretical answer is that you can just replace (errno == ERANGE) with
(errno != 0), or just (errno), if you still don't care about distinguishing
a base error. If you do care about distinguishing a base error, you can
just check its value directly, which, as I said, most people prefer over
trying to decode different funnily-named values of errno in my experience.

    if (!(base == 0 || base >= 2 && base <= 36))
        goto bad_base;
    char *end;
    errno = 0;
    value = strtol(ptr, &end, base);
    if (end == ptr)
        goto not_a_number;
    if (*end != '\0')
        goto trailing_garbage;
    if (errno == ERANGE) 
        goto overflow_error;
    /* the last could also be, e.g., if (value < 0 || value > MAX_VALUE) */

Thank you,
Matthew House