[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: buffer overflow in /bin/gzip?



On Wed, Nov 21, 2001 at 08:29:09AM +0100, Sebastian Rittau wrote:
> I hope strcpy() does not belong to this class. It's quite common to do
> something like this:
> 
> int len = strlen(s);
> char *new = (char *) malloc(len + 1);
> strcpy(new, s);
> 
> This is perfectly fine.

Albeit silly; you mean strdup()

> strncpy() is even more dangerous, since it doesn't add a final nul-byte if
> strlen(src) > n. Most people are not aware of this problem. So, most of
> the time you use strncpy() you should use a construction like this:
> 
> strncpy(dst, src, len);
> dst[len] = '\0';

Or use your own version of strncpy() which behaves more sensibly. This
is my preference.

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ | Dept. of Computing,
 `. `'                          | Imperial College,
   `-             -><-          | London, UK

Attachment: pgp9UFW9uRyc2.pgp
Description: PGP signature


Reply to: