<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">This patch reads as a dogmatic response to Visual Studio's bogus "deprecation" complaints.</span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">I think instead of swapping safe uses of one function for other functions simply to avoid specific parts of the standard library, we should discuss what our security goals are. LLVM has a lot of surface area and may be used in a lot of ways. Most conventional use cases of a compiler framework have no need for security, so if we do impose security guidelines, they should be discussed and codified.</span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">Perhaps before we follow this specific path we should enhance the Clang static analyzer to identify security issues we do care about and get a buildbot running that is checking the surface areas we have identified as needing to be secure for those issues?</span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">(Yes, I get that your employer may have some corporate standards you need to meet. Mine does too. Handling those needs in a constructive way is my goal here.)</span></div><br><span style="-webkit-text-size-adjust: auto;">Sent from my iPad</span></div><div style="-webkit-text-size-adjust: auto; "><br>On Oct 3, 2012, at 9:48 PM, "Martinez, Javier E" <<a href="mailto:javier.e.martinez@intel.com">javier.e.martinez@intel.com</a>> wrote:<br><br></div><blockquote type="cite" style="-webkit-text-size-adjust: auto; "><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Attached is a patch to remove the use of sscanf. The misuse of some C string functions such as sscanf can cause as security vulnerability. As discussed in the development mailing list the preference is to use string objects to manipulate
strings instead of the C functions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please review the patch and commit if the changes are ok.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Javier<o:p></o:p></p>
</div>
</div></blockquote><blockquote type="cite" style="-webkit-text-size-adjust: auto; "><div><sscanf.patch></div></blockquote><blockquote type="cite" style="-webkit-text-size-adjust: auto; "><div><span>_______________________________________________</span><br><span>llvm-commits mailing list</span><br><span><a href="mailto:llvm-commits@cs.uiuc.edu">llvm-commits@cs.uiuc.edu</a></span><br><span><a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits">http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits</a></span><br></div></blockquote></body></html>