Writing C for #curl
daniel.haxx.se/blog/2025/04/07…
Writing C for curl
It is a somewhat common question to me: how do we write C in curl to make it safe and secure for billions of installations? Some precautions we take and decisions we make. There is no silver bullet, just guidelines.daniel.haxx.se
daniel:// stenberg://
Unknown parent • • •Harald Eilertsen
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Harald Eilertsen • • •Akseli
in reply to daniel:// stenberg:// • • •Sensitive content
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •Writing C for Curl | Hacker News
news.ycombinator.comdaniel:// stenberg://
in reply to daniel:// stenberg:// • • •this quote made my day:
"Curl is one of the very few projects I managed to contribute to with a very simple PR.
At the time, I was a bit lost with their custom testing framework, but was very impressed by the ease of contributing to one of the most successful open-source project out there."
Bubu reshared this.
Marijke Luttekes
in reply to daniel:// stenberg:// • • •One of the best compliments for a project!
For OSS contributors, you could legit do a talk or series about how you made curl accessible to new contributors.
(Not to pile more work on you 😅)
daniel:// stenberg://
Unknown parent • • •Stefan Gast
in reply to daniel:// stenberg:// • • •L. Pereira
in reply to daniel:// stenberg:// • • •sscanf() can indeed have some weird and surprising behavior!
For instance, a while back, a fuzzer timed out on a sscanf("%d", ...), while looking for a space, and I ended up writing a workaround: github.com/lpereira/lwan/blob/…
(More important parts of the code aren't using this function anymore.)
lwan/src/lib/lwan-config.c at master · lpereira/lwan
GitHubdaniel:// stenberg://
in reply to L. Pereira • • •Abe Massry
in reply to daniel:// stenberg:// • • •Abe Massry
in reply to daniel:// stenberg:// • • •sry. Read the article
I have had it with these C bugs related to memory safety, on this HTTplane!
Gregory
in reply to daniel:// stenberg:// • • •Как мы пишем код для curl на C
PatientZero (Habr)