Re: Are bad developer libraries the problem with M$ software?

>As a side note, proper use of snprintf would be:

No it would not; the proper 2nd argument is the size of whatever "mystr" points to; for char[] that's sizeof (mystr) (NOT -1) but for char * it's whatever size you alloc'ed.

>Perhaps we should start development of a standardized 'safe' header file

I remember a bug in sendmail caused by bad use of sizef.

>#define safe_strcat(dst,src) =20
> strncat(dst,src,sizeof(dst))

Same problem; not safe anyway. (sizeof (dst) - strlen(dst) - 1, if anything)

Casper Received on Mon Nov 18 22:06:37 2002

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek