Skip to content

Bogus usage of strncpy in unit tests #58

@skliper

Description

@skliper

There are several places in OSAL where the Buffer Overflow protection
feature of the strncpy() function is used incorrectly, in a way that causes
it to not protect against buffer overflow.

Correct usage is to pass the size of the destination area as
the third argument, so strncpy() will stop before trying to write
past the end of the destination storage.

Incorrect usage observed is passing the length of the SOURCE string
as the limiting size. The resulting behavior is:

  • Call strlen() to get length of source data.
  • Call strncpy() to copy the string
  • strncpy() copies bytes until it sees NUL or copies N bytes.
  • in this case, it will always copy all data, and stop before the NUL.

The upshot of this is strncpy() always copies the whole source
string and never writes a terminating NUL.

Better usage would be to present the destination buffer size
as the limiting size in the 3rd argument (yes, strncpy() stops
writing after writing the NUL).

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions