@nabijaczleweli sizeof(10)?
I don’t know if I should go from eyebrow-rising to laugh or cry.
@lanodan @nabijaczleweli with someone later putting strlcpy and sizeof on top because insecure!!! but didn’t know how to actually write the secure version
(isn’t sizeof(10) just 4 or so?)
int at least, only case it can end up being equivalent to long is if it doesn't fits into unsigned int apparently.@mirabilos @nabijaczleweli Yeah, just prefer to never assume the size of int (IIRC it needs to be at least a certain size per POSIX, no idea for ISO C).
In any case, that code is absolutely horrible.
@lanodan @mirabilos only found by clang with "sprintf always truncated (4-byte destination, 5-byte minimum size)" warning! and I think these analyses are relatively fresh (and you sure as fuck don't get them on a full android build). one weeps for what bullshit's in there that /isn't/ caught by my heuristic-du-jour
btw there's some more in-and-around these, but both of them reduce to 1 line (cw gore):
https://review.lineageos.org/c/LineageOS/android_vendor_qcom_opensource_dataservices/+/431741
https://review.lineageos.org/c/LineageOS/android_vendor_qcom_opensource_dataservices/+/431742
https://review.lineageos.org/c/LineageOS/android_vendor_qcom_opensource_dataservices/+/431743
https://review.lineageos.org/c/LineageOS/android_vendor_qcom_opensource_dataservices/+/431746
@nabijaczleweli Well I already run gentoo so I've seen my fair share of weird to scary compiler warnings, even without a bleeding-edge compiler.
And I tend run scan-build on software I work on.
@nabijaczleweli whyyyyy is everything http ipv ssh? That’s insane.
Oh, right. Google.