Re: Implement C11 annex K?

[Rich Felker <dalias at libc dot org>]

On Wed, Aug 13, 2014 at 04:59:46PM -0700, Russ Allbery wrote:
> At the risk of drifting off into the weeds (and if you feel like this is
> inappropriate for this mailing list, please feel free to only respond in
> private or tell me that in private), how would you recommend writing this
> function without using strlcpy and strlcat?
> 
> /*
>  * Given a vector and a separator string, allocate and build a new string
>  * composed of all the strings in the vector separated from each other by the
>  * seperator string.  Caller is responsible for freeing.
>  */
> char *
> vector_join(const struct vector *vector, const char *seperator)
> {
>     char *string;
>     size_t i, size, seplen;
> 
>     /* If the vector is empty, this is trivial. */
>     assert(vector != NULL);
>     if (vector->count == 0)
>         return xstrdup("");
> 
>     /* Determine the total size of the resulting string. */
>     seplen = strlen(seperator);
>     for (size = 0, i = 0; i < vector->count; i++)
>         size += strlen(vector->strings[i]);
>     size += (vector->count - 1) * seplen + 1;
> 
>     /* Allocate the memory and build up the string using strlcat. */
>     string = xmalloc(size);
>     strlcpy(string, vector->strings[0], size);
>     for (i = 1; i < vector->count; i++) {
>         strlcat(string, seperator, size);
>         strlcat(string, vector->strings[i], size);
>     }
>     return string;
> }
> 
> If the answer is "use strcpy and strcat because this code is provably
> correct with them," I guess I understand your position, but if I somehow

The answer is "use memcpy". While statements of absolutes are
generally wrong, I'd venture very close to saying you should never use
any functions except snprintf and memcpy for constructing strings, at
least not unless you're an expert and willing to spend a lot of extra
time checking over your code to make sure you didn't make careless
errors.

There are a few places where strcpy is safe and efficient (e.g. when
you know a bound on the length of a string because it's a tail of a
string of known length, and thereby know that it fits in the
destination buffer, but you don't have the original pointer to get the
exact length and use memcpy) but these are definitely rare cases
rather than the norm.

Rich