Re: [Nmh-workers] Where are we at for 1.7.1?

2018-02-01 Thread Todd C. Miller
On Thu, 01 Feb 2018 17:09:31 +, Ralph Corderoy wrote: > Hi Todd, > > > CONFIGURE_ENV= ac_cv_header_db_h=no \ > > Out of interest, is that steering configure to not probe for db.h and > move on to another? Anything nmh should be doing better to avoid the > need for this and work bette

Re: [Nmh-workers] Where are we at for 1.7.1?

2018-01-31 Thread Todd C. Miller
On 31 Jan 2018 13:48:51 -0700, "Andy Bradford" wrote: > So it's interesting that even though I have libiconv installed, when I > build as indicated, I don't get iconv support linked in, but somehow the > port did (perhaps due to the LIB_DEPENDS) as mentioned previously. The OpenBSD C compiler d

Re: [Nmh-workers] strncpy(3), die, die, die.

2016-10-24 Thread Todd C. Miller
On Mon, 24 Oct 2016 22:10:46 +0100, Ralph Corderoy wrote: > Yes, asprintf(3) is very handy. Unfortunately, it's not standardised; C > nor POSIX. And rolling your own version around vsnprintf(3) can mean > doing the formatting twice; the first time to get the length. You've > then a malloc'd po

Re: [Nmh-workers] strncpy(3), die, die, die.

2016-10-24 Thread Todd C. Miller
On Mon, 24 Oct 2016 16:40:36 -0400, valdis.kletni...@vt.edu wrote: > In other words - if the source string doesn't fit, it will create > a non-NULL-terminated destination string for you. Repeat that, > slowly, until it sinks in. It says nothing of the sort, please re-read the manual. The source

Re: [Nmh-workers] strncpy(3), die, die, die.

2016-10-24 Thread Todd C. Miller
On Mon, 24 Oct 2016 19:59:10 -, P Vixie wrote: > I don't know what gcc or clang command line option to use to require this. If you declare the function with gcc's warn_unused_result attribute the compiler will warn when you don't check the result. For example: size_t strlcpy(char *dst,

Re: [Nmh-workers] strncpy(3), die, die, die.

2016-10-24 Thread Todd C. Miller
On Mon, 24 Oct 2016 18:59:36 -, P Vixie wrote: > Copy or die, as the default behavior. > > Silent truncation should require explicit coding. > > Strlcpy is completely bogus. Both snprintf() and strlcpy() make it fairly easy to detect whe the buffer was too small, which is more than I can sa

Re: [Nmh-workers] OpenBSD added to the buildbot cluster

2013-12-17 Thread Todd C. Miller
On Sun, 15 Dec 2013 21:34:04 -0800, Paul Vixie wrote: > my gripe with strlcat, strlcpy, and similar is silent truncation. the > openbsd team once sent me a huge block of diffs for bind8, altering > every strcpy to strlcpy, and so on. i rejected it, since silent > truncation is no less wrong than o