Hardened entire system

By using the nonnull attribute and replace buffer-overflow-prone
functions like strcpy, strcat and sprintf by strlcpy, strlcat and
snprintf.

31 files changed, 191 insertions, 171 deletions

diff --git a/libs/libc/alloc.c b/libs/libc/alloc.c
index b8139d0..485a60f 100644
--- a/libs/libc/alloc.c
+++ b/libs/libc/alloc.c
@@ -414,8 +414,7 @@ void *malloc_debug(u32 size, const char *file, int line, const char *func, const
 
 void free_debug(void *ptr, const char *file, int line, const char *func, const char *inp)
 {
-	if (ptr)
-		_free(ptr);
+	_free(ptr);
 
 	(void)file;
 	(void)line;
diff --git a/libs/libc/conv.c b/libs/libc/conv.c
index 670fdb3..bb68d7b 100644
--- a/libs/libc/conv.c
+++ b/libs/libc/conv.c
@@ -105,7 +105,7 @@ char *itoa(int n)
 
 	if (negative) {
 		char *aux = (char *)malloc((u32)(sz + 2));
-		strcpy(aux, ret);
+		strlcpy(aux, ret, sz + 2);
 		aux[sz] = '-';
 		aux[sz + 1] = 0;
 		free(ret);
diff --git a/libs/libc/cpu.c b/libs/libc/cpu.c
index 8ca4d27..37bdb4d 100644
--- a/libs/libc/cpu.c
+++ b/libs/libc/cpu.c
@@ -124,7 +124,7 @@ static void fpu_handler(struct regs *r)
 	__asm__ volatile("clts");
 }
 
-static u8 fpu_state[512] __attribute__((aligned(16)));
+static u8 fpu_state[512] ALIGNED(16);
 void fpu_restore(void)
 {
 	__asm__ volatile("fxrstor (%0)" ::"r"(fpu_state));
diff --git a/libs/libc/inc/conv.h b/libs/libc/inc/conv.h
index adf9003..95f7d02 100644
--- a/libs/libc/inc/conv.h
+++ b/libs/libc/inc/conv.h
@@ -5,11 +5,11 @@
 
 #include <def.h>
 
-int atoi(const char *str);
+int atoi(const char *str) NONNULL;
 char *htoa(u32 n);
-int htoi(const char *str);
+int htoi(const char *str) NONNULL;
 char *itoa(int n);
 
-char *conv_base(int value, char *result, int base, int is_signed);
+char *conv_base(int value, char *result, int base, int is_signed) NONNULL;
 
 #endif
diff --git a/libs/libc/inc/cpu.h b/libs/libc/inc/cpu.h
index d709d86..f96fa58 100644
--- a/libs/libc/inc/cpu.h
+++ b/libs/libc/inc/cpu.h
@@ -8,7 +8,7 @@
 u8 inb(u16 port);
 u16 inw(u16 port);
 u32 inl(u16 port);
-void insl(u16 port, void *addr, int n);
+void insl(u16 port, void *addr, int n) ATTR((nonnull(2)));
 
 void outb(u16 port, u8 data);
 void outw(u16 port, u16 data);
diff --git a/libs/libc/inc/crypto.h b/libs/libc/inc/crypto.h
index bbe8d7e..16cdf86 100644
--- a/libs/libc/inc/crypto.h
+++ b/libs/libc/inc/crypto.h
@@ -5,7 +5,7 @@
 
 #include <def.h>
 
-void md5(const void *initial_msg, u32 initial_len, u8 digest[16]);
-u32 crc32(u32 crc, const void *buf, u32 size);
+void md5(const void *initial_msg, u32 initial_len, u8 digest[16]) NONNULL;
+u32 crc32(u32 crc, const void *buf, u32 size) NONNULL;
 
 #endif
diff --git a/libs/libc/inc/def.h b/libs/libc/inc/def.h
index e71c502..378a4d0 100644
--- a/libs/libc/inc/def.h
+++ b/libs/libc/inc/def.h
@@ -30,11 +30,17 @@ typedef unsigned long long u64;
 
 #define ABS(a) ((u32)(((s32)(a) < 0) ? (-a) : (a)))
 
-#define NORETURN __attribute__((noreturn))
-#define DEPRECATED __attribute__((deprecated))
-#define NO_SANITIZE __attribute__((no_sanitize("undefined")))
-#define PACKED __attribute__((packed))
-#define ALIGNED(align) __attribute__((aligned(align)))
+#define ATTR __attribute__
+#define NORETURN ATTR((noreturn))
+#define DEPRECATED ATTR((deprecated))
+#define NONNULL ATTR((nonnull))
+#define PURE ATTR((pure))
+#define CONST ATTR((const))
+#define FLATTEN ATTR((flatten))
+#define PACKED ATTR((packed))
+#define HOT ATTR((hot))
+#define ALIGNED(align) ATTR((aligned(align)))
+#define NO_SANITIZE ATTR((no_sanitize("undefined")))
 
 #define EOF (-1)
 #define NULL ((void *)0)
diff --git a/libs/libc/inc/list.h b/libs/libc/inc/list.h
index 0b82b48..fea98dc 100644
--- a/libs/libc/inc/list.h
+++ b/libs/libc/inc/list.h
@@ -17,13 +17,13 @@ struct node {
 };
 
 struct list *list_new(void);
-void list_destroy(struct list *list);
+void list_destroy(struct list *list) NONNULL;
 /* struct node *list_new_node(); */ // TODO: Make node-specific things static/private?
 /* void list_add_node(struct list *list, struct node *node); */
-struct node *list_add(struct list *list, void *data);
-struct list *list_remove(struct list *list, struct node *node);
-struct node *list_last(struct list *list);
-struct list *list_swap(struct list *list, struct node *a, struct node *b);
-struct node *list_first_data(struct list *list, void *data);
+struct node *list_add(struct list *list, void *data) NONNULL;
+struct list *list_remove(struct list *list, struct node *node) NONNULL;
+struct node *list_last(struct list *list) NONNULL;
+struct list *list_swap(struct list *list, struct node *a, struct node *b) NONNULL;
+struct node *list_first_data(struct list *list, void *data) NONNULL;
 
 #endif
diff --git a/libs/libc/inc/mem.h b/libs/libc/inc/mem.h
index ec00628..2d55eff 100644
--- a/libs/libc/inc/mem.h
+++ b/libs/libc/inc/mem.h
@@ -5,8 +5,8 @@
 
 #include <def.h>
 
-void *malloc_debug(u32 size, const char *file, int line, const char *func, const char *inp);
-void free_debug(void *ptr, const char *file, int line, const char *func, const char *inp);
+void *malloc_debug(u32 size, const char *file, int line, const char *func, const char *inp) NONNULL;
+void free_debug(void *ptr, const char *file, int line, const char *func, const char *inp) NONNULL;
 #define malloc(size) malloc_debug((u32)(size), __FILE__, __LINE__, __func__, #size)
 #define free(ptr) free_debug((void *)(ptr), __FILE__, __LINE__, __func__, #ptr)
 void *realloc(void *ptr, u32 size);
@@ -20,10 +20,10 @@ void *zalloc(u32 size);
 #error "No lib target specified. Please use -Dkernel or -Duserspace"
 #endif
 
-void *memcpy(void *dest, const void *src, u32 n);
-void *memset(void *dest, int val, u32 n);
-void *memchr(void *src, int c, u32 n);
-int memcmp(const void *s1, const void *s2, u32 n);
-int mememp(const u8 *buf, u32 n);
+void *memcpy(void *dest, const void *src, u32 n) NONNULL;
+void *memset(void *dest, u32 val, u32 n) NONNULL;
+void *memchr(void *src, char c, u32 n) NONNULL;
+int memcmp(const void *s1, const void *s2, u32 n) NONNULL;
+int mememp(const u8 *buf, u32 n) NONNULL;
 
 #endif
diff --git a/libs/libc/inc/print.h b/libs/libc/inc/print.h
index 58b5dc6..751a929 100644
--- a/libs/libc/inc/print.h
+++ b/libs/libc/inc/print.h
@@ -3,24 +3,24 @@
 #ifndef PRINT_H
 #define PRINT_H
 
-#include "arg.h"
+#include <arg.h>
 #include <def.h>
 
-int printf(const char *format, ...);
-int vprintf(const char *format, va_list ap);
-int sprintf(char *str, const char *format, ...);
-int vsprintf(char *str, const char *format, va_list ap);
-int print(const char *str);
-NORETURN void panic(const char *format, ...);
+int printf(const char *format, ...) NONNULL;
+int vprintf(const char *format, va_list ap) NONNULL;
+int snprintf(char *str, u32 size, const char *format, ...) NONNULL;
+int vsnprintf(char *str, u32 size, const char *format, va_list ap) NONNULL;
+int print(const char *str) NONNULL;
+NORETURN void panic(const char *format, ...) NONNULL;
 
 #ifdef userspace
-int vfprintf(const char *path, const char *format, va_list ap);
-int fprintf(const char *path, const char *format, ...);
-int log(const char *format, ...);
-int err(int code, const char *format, ...);
+int vfprintf(const char *path, const char *format, va_list ap) NONNULL;
+int fprintf(const char *path, const char *format, ...) NONNULL;
+int log(const char *format, ...) NONNULL;
+int err(int code, const char *format, ...) NONNULL;
 #else
 #include <proc.h>
-int print_app(enum stream_defaults id, const char *proc_name, const char *str);
+int print_app(enum stream_defaults id, const char *proc_name, const char *str) NONNULL;
 void print_trace(u32 count);
 #endif
 
diff --git a/libs/libc/inc/stack.h b/libs/libc/inc/stack.h
index f5ad52b..54d1918 100644
--- a/libs/libc/inc/stack.h
+++ b/libs/libc/inc/stack.h
@@ -17,12 +17,12 @@ struct stack {
 };
 
 struct stack *stack_new(void);
-void stack_destroy(struct stack *stack);
-u32 stack_empty(struct stack *stack);
-u32 stack_push_bot(struct stack *stack, void *data);
-u32 stack_push(struct stack *stack, void *data);
-void *stack_pop(struct stack *stack);
-void *stack_peek(struct stack *stack);
-void stack_clear(struct stack *stack);
+void stack_destroy(struct stack *stack) NONNULL;
+u32 stack_empty(struct stack *stack) NONNULL;
+u32 stack_push_bot(struct stack *stack, void *data) NONNULL;
+u32 stack_push(struct stack *stack, void *data) NONNULL;
+void *stack_pop(struct stack *stack) NONNULL;
+void *stack_peek(struct stack *stack) NONNULL;
+void stack_clear(struct stack *stack) NONNULL;
 
 #endif
diff --git a/libs/libc/inc/str.h b/libs/libc/inc/str.h
index d0a521f..e77eeee 100644
--- a/libs/libc/inc/str.h
+++ b/libs/libc/inc/str.h
@@ -5,17 +5,15 @@
 
 #include <def.h>
 
-u32 strlen(const char *s);
-char *strcpy(char *dst, const char *src);
-char *strncpy(char *dst, const char *src, u32 n);
-char *strchr(char *s, int c);
-char *strrchr(char *s, int c);
-char *strcat(char *dst, const char *src);
-char *strncat(char *dst, const char *src, u32 n);
-int strcmp(const char *s1, const char *s2);
-int strncmp(const char *s1, const char *s2, u32 n);
-char *strinv(char *s);
-char *strdup(const char *s);
+u32 strlen(const char *s) NONNULL;
+u32 strlcpy(char *dst, const char *src, u32 size) NONNULL;
+char *strchr(char *s, int c) NONNULL;
+char *strrchr(char *s, int c) NONNULL;
+u32 strlcat(char *dst, const char *src, u32 size) NONNULL;
+int strcmp(const char *s1, const char *s2) NONNULL;
+int strncmp(const char *s1, const char *s2, u32 n) NONNULL;
+char *strinv(char *s) NONNULL;
+char *strdup(const char *s) NONNULL;
 
 const char *strerror(u32 err);
 
diff --git a/libs/libc/inc/sys.h b/libs/libc/inc/sys.h
index 19fb3ee..b555998 100644
--- a/libs/libc/inc/sys.h
+++ b/libs/libc/inc/sys.h
@@ -67,20 +67,20 @@ struct stat {
 
 void loop(void);
 void exit(s32 status);
-res read(const char *path, void *buf, u32 offset, u32 count);
-res write(const char *path, const void *buf, u32 offset, u32 count);
-res ioctl(const char *path, ...);
-res stat(const char *path, struct stat *buf);
-res poll(const char **files);
-res exec(const char *path, ...);
+res read(const char *path, void *buf, u32 offset, u32 count) NONNULL;
+res write(const char *path, const void *buf, u32 offset, u32 count) NONNULL;
+res ioctl(const char *path, ...) NONNULL;
+res stat(const char *path, struct stat *buf) NONNULL;
+res poll(const char **files) NONNULL;
+res exec(const char *path, ...) ATTR((nonnull(1)));
 res yield(void);
 res boot(u32 cmd);
 u32 time(void);
 
-res sys_alloc(u32 size, u32 *addr);
-res sys_free(void *ptr);
-res shalloc(u32 size, u32 *addr, u32 *id);
-res shaccess(u32 id, u32 *addr, u32 *size);
+res sys_alloc(u32 size, u32 *addr) NONNULL;
+res sys_free(void *ptr) NONNULL;
+res shalloc(u32 size, u32 *addr, u32 *id) NONNULL;
+res shaccess(u32 id, u32 *addr, u32 *size) NONNULL;
 
 static inline u32 getpid(void)
 {
@@ -93,12 +93,13 @@ static inline u32 getpid(void)
 
 #include <print.h>
 #include <str.h>
-static inline u32 pidof(const char *name)
+NONNULL static inline u32 pidof(const char *name)
 {
 	u32 curr = 1;
 	char buf[32] = { 0 }, path[32] = { 0 };
 	while (curr < 1000) { // Max pid??
-		if (sprintf(path, "/proc/%d/name", curr) > 0 && read(path, buf, 0, 32) > 0)
+		if (snprintf(path, sizeof(buf), "/proc/%d/name", curr) > 0 &&
+		    read(path, buf, 0, 32) > 0)
 			if (!strcmp(name, buf))
 				return curr;
 
@@ -110,7 +111,7 @@ static inline u32 pidof(const char *name)
 
 // Simple read wrapper
 #include <mem.h>
-static inline void *sread(const char *path)
+NONNULL static inline void *sread(const char *path)
 {
 	struct stat s = { 0 };
 	if (stat(path, &s) != 0 || !s.size)
diff --git a/libs/libc/list.c b/libs/libc/list.c
index c86b23d..1fc9a55 100644
--- a/libs/libc/list.c
+++ b/libs/libc/list.c
@@ -15,8 +15,6 @@ struct list *list_new(void)
 
 void list_destroy(struct list *list)
 {
-	if (!list)
-		return;
 	struct node *iterator = list->head;
 	while (iterator != NULL) {
 		if (iterator->next == NULL) {
@@ -41,11 +39,8 @@ static struct node *list_new_node(void)
 	return node;
 }
 
-static struct node *list_add_node(struct list *list, struct node *node)
+NONNULL static struct node *list_add_node(struct list *list, struct node *node)
 {
-	if (!list || !node)
-		return NULL;
-
 	if (list->head == NULL) {
 		list->head = node;
 		return list->head;
@@ -65,7 +60,7 @@ static struct node *list_add_node(struct list *list, struct node *node)
 
 struct node *list_last(struct list *list)
 {
-	if (!list || !list->head)
+	if (list->head)
 		return NULL;
 
 	struct node *iterator = list->head;
@@ -80,7 +75,7 @@ struct node *list_last(struct list *list)
 
 struct node *list_first_data(struct list *list, void *data)
 {
-	if (!list || !list->head || !data)
+	if (!list->head)
 		return NULL;
 
 	struct node *iterator = list->head;
@@ -96,7 +91,7 @@ struct node *list_first_data(struct list *list, void *data)
 // TODO: Actually swap the nodes, not the data
 struct list *list_swap(struct list *list, struct node *a, struct node *b)
 {
-	if (!list || !list->head || !a || !b)
+	if (!list->head)
 		return NULL;
 
 	void *tmp = a->data;
@@ -116,7 +111,7 @@ struct node *list_add(struct list *list, void *data)
 // Maybe list_remove_node?
 struct list *list_remove(struct list *list, struct node *node)
 {
-	if (!list || !list->head || !node)
+	if (!list->head)
 		return NULL;
 
 	if (list->head == node) {
diff --git a/libs/libc/mem.c b/libs/libc/mem.c
index 95242e4..2e457ef 100644
--- a/libs/libc/mem.c
+++ b/libs/libc/mem.c
@@ -64,7 +64,7 @@ void *memcpy(void *dest, const void *src, u32 n)
 #endif
 }
 
-void *memset(void *dest, int val, u32 n)
+void *memset(void *dest, u32 val, u32 n)
 {
 	u32 uval = val;
 	u32 num_dwords = n / 4;
@@ -90,7 +90,7 @@ void *memset(void *dest, int val, u32 n)
 	return dest;
 }
 
-void *memchr(void *src, int c, u32 n)
+void *memchr(void *src, char c, u32 n)
 {
 	u8 *s = (u8 *)src;
 
diff --git a/libs/libc/print.c b/libs/libc/print.c
index 2422fed..7c19628 100644
--- a/libs/libc/print.c
+++ b/libs/libc/print.c
@@ -15,13 +15,15 @@ static void append(char *dest, char *src, int index)
 	dest[index + strlen(src)] = 0;
 }
 
-int vsprintf(char *str, const char *format, va_list ap)
+int vsnprintf(char *str, u32 size, const char *format, va_list ap)
 {
 	u8 ready_to_format = 0;
 
-	int i = 0;
+	u32 i = 0;
 	char buf = 0;
-	char format_buffer[20] = { '\0' };
+
+	// TODO: Fix format buffer overflow exploit
+	char format_buffer[42] = { 0 };
 
 	for (; *format; format++) {
 		if (ready_to_format) {
@@ -71,21 +73,24 @@ int vsprintf(char *str, const char *format, va_list ap)
 				ready_to_format = 1;
 			else {
 				str[i] = *format;
-				i++;
+				if (++i == size) {
+					str[i] = 0;
+					break;
+				}
 			}
 		}
 
-		format_buffer[0] = '\0';
+		memset(format_buffer, 0, sizeof(format_buffer));
 	}
 
 	return strlen(str);
 }
 
-int sprintf(char *str, const char *format, ...)
+int snprintf(char *str, u32 size, const char *format, ...)
 {
 	va_list ap;
 	va_start(ap, format);
-	int len = vsprintf(str, format, ap);
+	int len = vsnprintf(str, size, format, ap);
 	va_end(ap);
 
 	return len;
@@ -106,7 +111,7 @@ int vprintf(const char *format, va_list ap)
 int vfprintf(const char *path, const char *format, va_list ap)
 {
 	char buf[1024] = { 0 };
-	int len = vsprintf(buf, format, ap);
+	int len = vsnprintf(buf, sizeof(buf), format, ap);
 	return write(path, buf, 0, len);
 }
 
@@ -185,7 +190,7 @@ static void print_kernel(const char *str)
 int vprintf(const char *format, va_list ap)
 {
 	char buf[1024] = { 0 };
-	int len = vsprintf(buf, format, ap);
+	int len = vsnprintf(buf, sizeof(buf), format, ap);
 	print_kernel(buf);
 	return len;
 }
@@ -242,7 +247,7 @@ NORETURN void panic(const char *format, ...)
 	char buf[1024] = { 0 };
 	va_list ap;
 	va_start(ap, format);
-	vsprintf(buf, format, ap);
+	vsnprintf(buf, sizeof(buf), format, ap);
 	va_end(ap);
 #ifdef kernel
 	print("--- DON'T PANIC! ---\n");
diff --git a/libs/libc/sanitize.c b/libs/libc/sanitize.c
index 39ab44f..415b790 100644
--- a/libs/libc/sanitize.c
+++ b/libs/libc/sanitize.c
@@ -49,6 +49,12 @@ struct type_mismatch {
 	u8 type_check_kind;
 };
 
+struct nonnull_arg {
+	struct source_location location;
+	struct source_location attribute_location;
+	u32 index;
+};
+
 struct overflow {
 	struct source_location location;
 	struct type_descriptor *type;
@@ -66,16 +72,18 @@ void __ubsan_handle_load_invalid_value(void)
 	panic("UBSAN: load-invalid-value\n");
 }
 
-void __ubsan_handle_nonnull_arg(void);
-void __ubsan_handle_nonnull_arg(void)
+void __ubsan_handle_nonnull_arg(struct nonnull_arg *data);
+void __ubsan_handle_nonnull_arg(struct nonnull_arg *data)
 {
-	panic("UBSAN: nonnull-arg\n");
+	struct source_location *loc = &data->location;
+	panic("%s:%d: UBSAN: nonnull-arg [index: %d]\n", loc->file, loc->line, data->index);
 }
 
-void __ubsan_handle_nullability_arg(void);
-void __ubsan_handle_nullability_arg(void)
+void __ubsan_handle_nullability_arg(struct nonnull_arg *data);
+void __ubsan_handle_nullability_arg(struct nonnull_arg *data)
 {
-	panic("UBSAN: nullability-arg\n");
+	struct source_location *loc = &data->location;
+	panic("%s:%d: UBSAN: nonnull-arg [index: %d]\n", loc->file, loc->line, data->index);
 }
 
 void __ubsan_handle_nonnull_return_v1(void);
diff --git a/libs/libc/stack.c b/libs/libc/stack.c
index 0cbb69d..6f16709 100644
--- a/libs/libc/stack.c
+++ b/libs/libc/stack.c
@@ -39,11 +39,8 @@ static struct stack_node *stack_new_node(void)
 	return node;
 }
 
-static u32 stack_push_bot_node(struct stack *stack, struct stack_node *node)
+NONNULL static u32 stack_push_bot_node(struct stack *stack, struct stack_node *node)
 {
-	if (!stack || !node)
-		return 0;
-
 	if (stack->tail) {
 		struct stack_node *iterator = stack->tail;
 		while (iterator) {
@@ -60,11 +57,8 @@ static u32 stack_push_bot_node(struct stack *stack, struct stack_node *node)
 	return 1;
 }
 
-static u32 stack_push_node(struct stack *stack, struct stack_node *node)
+NONNULL static u32 stack_push_node(struct stack *stack, struct stack_node *node)
 {
-	if (!stack || !node)
-		return 0;
-
 	if (stack->tail) {
 		stack->tail->next = node;
 		node->prev = stack->tail;
@@ -97,7 +91,7 @@ u32 stack_push(struct stack *stack, void *data)
 
 void *stack_pop(struct stack *stack)
 {
-	if (!stack || !stack->tail)
+	if (!stack->tail)
 		return NULL;
 
 	struct stack_node *prev = stack->tail;
@@ -113,7 +107,7 @@ void *stack_pop(struct stack *stack)
 
 void *stack_peek(struct stack *stack)
 {
-	if (!stack || !stack->tail)
+	if (!stack->tail)
 		return NULL;
 
 	return stack->tail->data;
diff --git a/libs/libc/str.c b/libs/libc/str.c
index ba16920..3bc3aaf 100644
--- a/libs/libc/str.c
+++ b/libs/libc/str.c
@@ -5,35 +5,32 @@
 #include <mem.h>
 #include <str.h>
 
-u32 strlen(const char *s)
+u32 strlen(const char *str)
 {
-	const char *ss = s;
-	while (*ss)
-		ss++;
-	return ss - s;
-}
-
-char *strcpy(char *dst, const char *src)
-{
-	char *q = dst;
-	const char *p = src;
-	char ch;
-
-	do {
-		*q++ = ch = *p++;
-	} while (ch);
-
-	return dst;
+	const char *s = str;
+	while (*s)
+		s++;
+	return s - str;
 }
 
-char *strncpy(char *dst, const char *src, u32 n)
+u32 strlcpy(char *dst, const char *src, u32 size)
 {
-	char *q = dst;
-
-	while (n-- && (*dst++ = *src++))
-		;
+	const char *orig = src;
+	u32 left = size;
+
+	if (left)
+		while (--left)
+			if (!(*dst++ = *src++))
+				break;
+
+	if (!left) {
+		if (!size)
+			*dst = 0;
+		while (*src++)
+			;
+	}
 
-	return q;
+	return src - orig - 1;
 }
 
 int strcmp(const char *s1, const char *s2)
@@ -91,16 +88,32 @@ char *strrchr(char *s, int c)
 	return ret;
 }
 
-char *strcat(char *dst, const char *src)
+u32 strlcat(char *dst, const char *src, u32 size)
 {
-	strcpy(strchr(dst, '\0'), src);
-	return dst;
-}
+	const char *orig_dst = dst;
+	const char *orig_src = src;
 
-char *strncat(char *dst, const char *src, u32 n)
-{
-	strncpy(strchr(dst, '\0'), src, n);
-	return dst;
+	u32 n = size;
+	while (n-- && *dst)
+		dst++;
+
+	u32 len = dst - orig_dst;
+	n = size - len;
+
+	if (!n--)
+		return len + strlen(src);
+
+	while (*src) {
+		if (n) {
+			*dst++ = *src;
+			n--;
+		}
+		src++;
+	}
+
+	src = 0;
+
+	return len + (src - orig_src);
 }
 
 char *strinv(char *s)
diff --git a/libs/libgui/bmp.h b/libs/libgui/bmp.h
index ff8360b..f7fb57f 100644
--- a/libs/libgui/bmp.h
+++ b/libs/libgui/bmp.h
@@ -11,7 +11,7 @@ struct bmp_header {
 	u32 size;
 	u32 reserved;
 	u32 offset;
-} __attribute__((packed));
+} PACKED;
 
 struct bmp_info {
 	u32 size;
@@ -34,6 +34,6 @@ struct bmp {
 	u32 pitch;
 };
 
-struct bmp *bmp_load(const char *path);
+struct bmp *bmp_load(const char *path) NONNULL;
 
 #endif
diff --git a/libs/libgui/gfx.h b/libs/libgui/gfx.h
index 83736fd..082fe07 100644
--- a/libs/libgui/gfx.h
+++ b/libs/libgui/gfx.h
@@ -66,18 +66,21 @@ struct context {
 	u32 bytes;
 };
 
-struct context *gfx_new_ctx(struct context *ctx, vec2 size, u8 bpp);
+struct context *gfx_new_ctx(struct context *ctx, vec2 size, u8 bpp) NONNULL;
 struct font *gfx_resolve_font(enum font_type font_type);
-void gfx_write_char(struct context *ctx, vec2 pos, enum font_type font_type, u32 c, char ch);
-void gfx_write(struct context *ctx, vec2 pos, enum font_type font_type, u32 c, const char *text);
-void gfx_load_image(struct context *ctx, vec2 pos, const char *path);
-void gfx_load_image_filter(struct context *ctx, vec2 pos, enum gfx_filter filter, const char *path);
-void gfx_load_wallpaper(struct context *ctx, const char *path);
-void gfx_copy(struct context *dest, struct context *src, vec2 pos, vec2 size);
-void gfx_ctx_on_ctx(struct context *dest, struct context *src, vec2 pos);
-void gfx_draw_rectangle(struct context *ctx, vec2 pos1, vec2 pos2, u32 c);
-void gfx_fill(struct context *ctx, u32 c);
-void gfx_border(struct context *ctx, u32 c, u32 width);
+void gfx_write_char(struct context *ctx, vec2 pos, enum font_type font_type, u32 c,
+		    char ch) NONNULL;
+void gfx_write(struct context *ctx, vec2 pos, enum font_type font_type, u32 c,
+	       const char *text) NONNULL;
+void gfx_load_image(struct context *ctx, vec2 pos, const char *path) NONNULL;
+void gfx_load_image_filter(struct context *ctx, vec2 pos, enum gfx_filter filter,
+			   const char *path) NONNULL;
+void gfx_load_wallpaper(struct context *ctx, const char *path) NONNULL;
+void gfx_copy(struct context *dest, struct context *src, vec2 pos, vec2 size) NONNULL;
+void gfx_ctx_on_ctx(struct context *dest, struct context *src, vec2 pos) NONNULL;
+void gfx_draw_rectangle(struct context *ctx, vec2 pos1, vec2 pos2, u32 c) NONNULL;
+void gfx_fill(struct context *ctx, u32 c) NONNULL;
+void gfx_border(struct context *ctx, u32 c, u32 width) NONNULL;
 
 int gfx_font_height(enum font_type);
 int gfx_font_width(enum font_type);
diff --git a/libs/libgui/gui.h b/libs/libgui/gui.h
index 5190155..f4c213b 100644
--- a/libs/libgui/gui.h
+++ b/libs/libgui/gui.h
@@ -23,9 +23,9 @@ res gui_redraw_window(u32 id);
 
 res gui_fill(u32 win_id, u32 widget_id, enum gui_layer layer, u32 c);
 res gui_load_image(u32 win_id, u32 widget_id, enum gui_layer layer, vec2 pos, vec2 size,
-		   const char *path);
+		   const char *path) NONNULL;
 res gui_load_image_filter(u32 win_id, u32 widget_id, enum gui_layer layer, vec2 pos, vec2 size,
-			  enum gfx_filter filter, const char *path);
+			  enum gfx_filter filter, const char *path) NONNULL;
 
 res gui_add_widget(u32 win_id, u32 widget_id, vec2 size, vec2 pos);
 res gui_new_widget(u32 win_id, vec2 size, vec2 pos);
diff --git a/libs/libgui/msg.c b/libs/libgui/msg.c
index 73af242..051072e 100644
--- a/libs/libgui/msg.c
+++ b/libs/libgui/msg.c
@@ -8,11 +8,9 @@
 
 res msg_send(u32 pid, enum message_type type, void *data, u32 size)
 {
-	if (!data)
-		return -EFAULT;
 	assert((signed)pid != -1 && size >= sizeof(struct message_header));
 	char path[32] = { 0 };
-	sprintf(path, "/proc/%d/msg", pid);
+	snprintf(path, sizeof(path), "/proc/%d/msg", pid);
 	struct message_header *header = data;
 	header->magic = MSG_MAGIC;
 	header->src = getpid();
diff --git a/libs/libgui/msg.h b/libs/libgui/msg.h
index 65fc640..c25e95e 100644
--- a/libs/libgui/msg.h
+++ b/libs/libgui/msg.h
@@ -66,7 +66,7 @@ enum message_type {
 	GUI_KEYBOARD,
 };
 
-res msg_send(u32 pid, enum message_type type, void *data, u32 size);
-res msg_receive(void *buf, u32 size);
+res msg_send(u32 pid, enum message_type type, void *data, u32 size) NONNULL;
+res msg_receive(void *buf, u32 size) NONNULL;
 
 #endif
diff --git a/libs/libgui/png.c b/libs/libgui/png.c
index 6f8f4b5..2ff3340 100644
--- a/libs/libgui/png.c
+++ b/libs/libgui/png.c
@@ -90,7 +90,8 @@ static void *png_realloc(void *ptr, u32 new_size)
 
 static void png_free(void *ptr)
 {
-	free(ptr);
+	if (ptr)
+		free(ptr);
 }
 #else /*PNG_COMPILE_ALLOCATORS*/
 /* TODO: support giving additional void* payload to the custom allocators */
diff --git a/libs/libgui/psf.c b/libs/libgui/psf.c
index e28c2d7..751421a 100644
--- a/libs/libgui/psf.c
+++ b/libs/libgui/psf.c
@@ -25,9 +25,6 @@ static int psf_verify(char *data)
 
 struct font *psf_parse(char *data)
 {
-	if (!data)
-		return NULL;
-
 	int version = psf_verify(data);
 
 	char *chars;
diff --git a/libs/libgui/psf.h b/libs/libgui/psf.h
index 63a3d1e..4d63118 100644
--- a/libs/libgui/psf.h
+++ b/libs/libgui/psf.h
@@ -43,6 +43,6 @@ struct psf2_header {
 	u32 width;
 };
 
-struct font *psf_parse(char *data);
+struct font *psf_parse(char *data) NONNULL;
 
 #endif
diff --git a/libs/libnet/dns.c b/libs/libnet/dns.c
index f20f33a..e179bd6 100644
--- a/libs/libnet/dns.c
+++ b/libs/libnet/dns.c
@@ -20,7 +20,7 @@ struct dns_packet {
 	u16 authorities;
 	u16 additional;
 	u8 data[];
-} __attribute__((packed));
+} PACKED;
 
 static u32 part_count(const char *name)
 {
diff --git a/libs/libtxt/html.h b/libs/libtxt/html.h
index c1b29f2..ea2cfb8 100644
--- a/libs/libtxt/html.h
+++ b/libs/libtxt/html.h
@@ -21,6 +21,6 @@ struct html_element {
 	struct element *obj;
 };
 
-int html_render(struct element *container, char *data, u32 length);
+int html_render(struct element *container, char *data, u32 length) NONNULL;
 
 #endif
diff --git a/libs/libtxt/keymap.h b/libs/libtxt/keymap.h
index 9f1966e..4f5512f 100644
--- a/libs/libtxt/keymap.h
+++ b/libs/libtxt/keymap.h
@@ -3,6 +3,8 @@
 #ifndef KEYMAP_H
 #define KEYMAP_H
 
+#include <def.h>
+
 #define KEYMAP_LENGTH 90
 
 struct keymap {
@@ -11,6 +13,6 @@ struct keymap {
 	char alt_map[KEYMAP_LENGTH];
 };
 
-struct keymap *keymap_parse(const char *path);
+struct keymap *keymap_parse(const char *path) NONNULL;
 
 #endif
diff --git a/libs/libtxt/xml.h b/libs/libtxt/xml.h
index 43a8005..3f5c74d 100644
--- a/libs/libtxt/xml.h
+++ b/libs/libtxt/xml.h
@@ -44,8 +44,8 @@ struct xml {
 };
 
 enum xml_error xml_parse(struct xml *parser, const char *buffer, u32 buffer_length,
-			 struct xml_token *tokens, u32 num_tokens);
+			 struct xml_token *tokens, u32 num_tokens) NONNULL;
 
-void xml_init(struct xml *parser);
+void xml_init(struct xml *parser) NONNULL;
 
 #endif