> Down to business. Why keep the parantheses? Please feel free to give
> either stylistic or security-oriented arguments.
more parentheses -> more clarity -> less confusion.
it's easier to write and audit code when you can
clearly see what it does. it's style that should be
kept throughout the code; not sizeof-specific, but
consistency is also important. :)
> A nice idea when you are starting a project from scratch. I dislike
> introducing non-standard (as strlcpy()/strlcat() regrettably are)
> functions to an existing project due to their non-self-descriptiveness
> as compared to use of known functions.
you dislike, but you do what's best for the users. the
developers can live with a "i just added strlcpy and
strlcat, man-page is at [url], use them". users don't
trust software with a bad security history... (imho)
> Allow me to tap into your fullofitness, then. Perhaps your Google is
> not my Google, but if you're aware of an snprintf()-avoiding
> technique, I'd like to hear about it. The only one I'm aware of
> involves I/O.
i meant "search for [quote] no snprintf [unquote] on
google for the solutions other people used in such a
situation, as you're obviously not the first, and win32
is definately not an obscure OS as some exotic others.
> I thought MSDN search for "snprintf" would give me at least a parallel
> answer. I should not have been so optimistic.
yeah, i'm aware of how poor MSDN is. however,
the above-described google search plus the word
win32 will give you some enlightening results.
...and i hear microsoft has a new book about secure
programming? did you try it?