strtok behaviour when uninitialized

[Zack Weinberg]

On Sun, Feb 11, 2018 at 2:08 PM, Javier Serrano Polo <javier@jasp.net> wrote:
> El dg 11 de 02 de 2018 a les 13:53 -0500, Salil Kapur va escriure:
>> Why keep it undefined?
>
> Undefined behavior means efficiency. The most efficient implementation
> will either crash or not.

With my security hat on, I would like glibc to define as many cases of
undefined behavior as possible -- as prompt, guaranteed crashes.
Defining the behavior as anything else leads to people relying on
whatever the definition is, but leaving it as "whatever the code
happens to do" _also_ leads to people relying on the actual behavior,
plus it leaves room for exploits.

(I'd make an exception for memory copies: I think those should _all_
be defined by us to behave as-if by calling memmove().  Yes, really.
Yes, including memcpy.)

zw