[hnbroseph]

can you be more specific about these practices?

[Gibbon1]

What ufo said

> implements strcpy as `while(dst++ = dst++);

The book is full of stuff like that.

[cma]

Doesn't strcpy always have that issue? The terseness is one issue, but the security problem is that it implements strcpy at all without warning.

[iamnotacrook]

You tend to get warnings to use the _s versions of some functions (strcpy_s in this case) these days.

[cesarb]

I just tried (with gcc 9.2.1), and got no warning. As far as I know, these _s versions aren't that good, and often aren't available at all; see http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1967.htm which says among other things

"[...] none of the popular Open Source distribution such as BSD or Linux has chosen to make either available to their users. At least one (GNU C Library) has repeatedly rejected proposals for inclusion [...]"

"[...] As a result of the numerous deviations from the specification the Microsoft implementation cannot be considered conforming or portable."

[iamnotacrook]

"often aren't available at all"

It's in C11. Perhaps Red Hat use non-compliant compilers, or very, very old ones?

[cesarb]

It's an optional part of C11, which means that even a fully compliant compiler does not have to implement them.

[lone_haxx0r]

strcpy_s has no manual entry on Ubuntu, while "man strcpy" and "man strncpy" work as expected.

Why would that be?