diff mbox series

[v2,6/6] banned.h: mark `strtok()` as banned

Message ID 56d2318a6d0aa17e2d56cd7d7e755adae89f8d99.1681845518.git.me@ttaylorr.com (mailing list archive)
State New, archived
Headers show
Series banned: mark `strok()` as banned | expand

Commit Message

Taylor Blau April 18, 2023, 7:18 p.m. UTC 
`strtok_r()` is reentrant, but `strtok()` is not, meaning that using it
is not thread-safe.

`strtok()` has a couple of drawbacks that make it undesirable to have
any new instances. In addition to being thread-unsafe, it also
encourages confusing data flows, where `strtok()` may be called from
multiple functions with its first argument as NULL, making it unclear
from the immediate context which string is being tokenized.

Now that we have removed all instances of `strtok()` from the tree,
let's ban `strtok()` to avoid introducing new ones in the future. If new
callers should arise, they can either use:

  - `string_list_split_in_place()`,
  - `string_list_split_in_place_multi()`, or
  - `strtok_r()`.

Callers are encouraged to use either of the string_list functions when
appropriate over `strtok_r()`, since the latter suffers from the same
confusing data-flow problem as `strtok()` does.

But callers may prefer `strtok_r()` when the number of tokens in a given
string is unknown, and they want to split and process them one at a
time, so `strtok_r()` is left off the banned.h list.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 banned.h | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/banned.h b/banned.h
index 6ccf46bc19..dd43ab3178 100644
--- a/banned.h
+++ b/banned.h
@@ -18,6 +18,8 @@ 
 #define strncpy(x,y,n) BANNED(strncpy)
 #undef strncat
 #define strncat(x,y,n) BANNED(strncat)
+#undef strtok
+#define strtok(x,y) BANNED(strtok)
 
 #undef sprintf
 #undef vsprintf