Re: [PATCH] blame: prefer xsnprintf to strcpy for colors
- From
Stefan Beller <sbeller@google.com>
- Date
- Jul 13, 2018, 20:58 UTC
- Message-ID
- <CAGZ79kakrS_tk=x4Rb9qSu9e4RVSJ=J64eOdasKhOy=g8kV68w@mail.gmail.com>
- In-Reply-To
- <20180713204350.GA16999@sigill.intra.peff.net>
On Fri, Jul 13, 2018 at 1:43 PM Jeff King <peff@peff.net> wrote:
Show 5 quoted lines
> --- > Another option would just be color_parse(repeated_meta_color, "cyan"). > The run-time cost is slightly higher, but it probably doesn't matter > here, and perhaps it's more readable. >
Thanks for posting this again; this looks good to me! Stefan
> I'm sad that this strcpy() wasn't caught in review. IMHO we should avoid > that function altogether, even when we _think_ it can't trigger an > overflow. That's easier to reason about (and makes auditing easier).
Can we somehow automatically find "bad code" either in pathces or in new code (such as pu), e.g. as a coccicheck for these functions?