-
Notifications
You must be signed in to change notification settings - Fork 253
Closed
Labels
Description
There are several places in OSAL where the Buffer Overflow protection
feature of the strncpy() function is used incorrectly, in a way that causes
it to not protect against buffer overflow.
Correct usage is to pass the size of the destination area as
the third argument, so strncpy() will stop before trying to write
past the end of the destination storage.
Incorrect usage observed is passing the length of the SOURCE string
as the limiting size. The resulting behavior is:
- Call strlen() to get length of source data.
- Call strncpy() to copy the string
- strncpy() copies bytes until it sees NUL or copies N bytes.
- in this case, it will always copy all data, and stop before the NUL.
The upshot of this is strncpy() always copies the whole source
string and never writes a terminating NUL.
Better usage would be to present the destination buffer size
as the limiting size in the 3rd argument (yes, strncpy() stops
writing after writing the NUL).
Reactions are currently unavailable