The Linux Kernel Eliminated This Entire C Function
You wouldn't often think that an entire C function would need to be eliminated from the kernel but recently exactly that was done. ==========Support The Channel========== ► Patreon: https://brodierobertson.xyz/patreon ► Paypal: https://brodierobertson.xyz/paypal ► Liberapay: https://brodierobertson.xyz/liberapay ► Amazon USA: https://brodierobertson.xyz/amazonusa ==========Resources========== Mastodon Post: https://hachyderm.io/@kees/116282745861595200 2020 Work: https://github.com/KSPP/linux/issues/90 Recent Merge: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=dev/v7.0-rc2/strncpy&id=be568570cf71c5db5d6039ac077d90e3767c2fe1 Strncpy: https://stackoverflow.com/questions/1258550/why-should-you-use-strncpy-instead-of-strcpy Older Post: https://randomascii.wordpress.com/2013/04/03/stop-using-strncpy-already/ =========Video Platforms========== 🎥 React: https://www.youtube.com/@BrodieRobertsonReacts 🎥 Podcast: https://techovertea.xyz/youtube 🎮 Gaming: https://brodierobertson.xyz/gaming ==========Social Media========== 🎤 Discord: https://brodierobertson.xyz/discord 🐦 Twitter: https://brodierobertson.xyz/twitter 🌐 Mastodon: https://brodierobertson.xyz/mastodon 🖥️ GitHub: https://brodierobertson.xyz/github ==========Credits========== 🎨 Channel Art: Profile Picture: https://www.instagram.com/supercozman_draws/ #Linux #Linuxkernel #FOSS #OpenSoure #Kernel 🎵 Ending music Track: Debris & Jonth - Game Time [NCS Release] Music provided by NoCopyrightSounds. Watch: https://www.youtube.com/watch?v=yDTvvOTie0w Free Download / Stream: http://ncs.io/GameTime DISCLOSURE: Wherever possible I use referral links, which means if you click one of the links in this video or description and make a purchase I may receive a small commission or other compensation.
Video Chapters
- 0:05 After 6 years and 362 commits, a legacy C function is gone
- 1:32 The catastrophic risk of missing null terminators
- 2:55 Why the old standard was inefficient and prone to errors
- 4:03 The flawed evolution from strcpy to strncpy
- 5:47 How the Kernel is implementing safe string wrappers
- 6:53 Why many standard "n" functions are just as dangerous
- 8:09 The surprising flaws in "modern" string alternatives
- 9:04 Why manual buffer sizing is a recipe for disaster
- 10:58 Why cleaning up legacy code is essential for security
Original Output
0:05 After 6 years and 362 commits, a legacy C function is gone 1:32 The catastrophic risk of missing null terminators 2:55 Why the old standard was inefficient and prone to errors 4:03 The flawed evolution from strcpy to strncpy 5:47 How the Kernel is implementing safe string wrappers 6:53 Why many standard "n" functions are just as dangerous 8:09 The surprising flaws in "modern" string alternatives 9:04 Why manual buffer sizing is a recipe for disaster 10:58 Why cleaning up legacy code is essential for security Timestamps by StampBot 🤖 (547-the-linux-kernel-eliminated-this-entire-c-function)
Unprocessed Timestamp Content
0:00 Linux kernel celebrates removing the problematic strncpy function 0:05 Kees Cook announced `strncpy` removal, 6 years and 362 commits later 0:25 Why remove `strncpy`? It copies strings, what's the big deal? 0:42 `strncpy` copies part of a string but has ambiguous semantics 1:18 C strings use a null character to mark the end of a string 1:32 Without null termination, reading off-string can lead to segfaults 1:57 An attacker might gain unauthorized memory access due to these bugs 2:15 Developers knew about `strncpy`'s problems for over 16 years 2:55 `strncpy` also zero-pads the full length, which wastes memory 4:03 `strncpy` replaced the even more problematic `strcpy` which copied everything 4:47 `strcpy` can easily cause buffer overflows if the destination is small 5:11 `strncpy` fixes buffer overflows but still makes null termination ambiguous 5:47 The kernel's solution: create safe wrapper functions for string operations 6:53 Other "n" functions also have similar ambiguous null-termination issues 8:09 Even `strlcpy` and `lstrlcpy` have their own share of problems 9:04 Programmers frequently miscalculate buffer sizes, leading to errors 9:52 The best solution is to define and use safe wrapper functions consistently 10:58 Sometimes development-related content is useful and not always drama Timestamps by StampBot 🤖 (547-the-linux-kernel-eliminated-this-entire-c-function)