RE: Are bad developer libraries the problem with M$ software?

>>C'mon people, this really is beginner stuff.

What's truly interesting about this, is this is how buffer overruns occur!! Simply incorrect assumptions. When I speak to large developer audiences I always ask, "how many of you think you must accommodate the for the trailing '\0' character when determining buffer size in the 'n' functions?", overwhelmingly, 50% say yes, and 50% say no.

Cheers, Michael
Secure Windows Initiative
Writing Secure Code
http://www.microsoft.com/mspress/books/5612.asp -----Original Message-----
From: Andrew Dalgleish [mailto:secprog@andrewdalgleish.dyndns.org] Sent: Tuesday, November 19, 2002 2:58 PM To: secprog@securityfocus.com

On Mon, Nov 18, 2002 at 09:25:46PM -0600, Frank Knobbe wrote:
> On Mon, 2002-11-18 at 17:10, Andrew Griffiths wrote:
long.
> >
> > In specific,
> >
> > 50 - 50 - 1 == -1
>
> If sizeof(dst) is 50, then a 0 terminated string is is 49 chars long

> there is no room left in dst.
>
> Of course in your example you allow dst to overflow in the strncpy.
> Using
> strncpy(dst, user_supplied_data, sizeof(dst)-1); would have
> prevented that if my math is correct.

No, it would not. strncpy does NOT append the trailing 0 if the length of the source is greater than or equal to the count.

Using sizeof(dst)-1 will leave the last byte in the buffer unchanged. If dst is on the stack there is no guarantee the string is terminated. To be sure, you would *also* need to add dst[sizeof(dst)-1] = 0;

C'mon people, this really is beginner stuff. Please RTFM before you post well-meaning advice.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

You might also like to look at the bsd-style strlcpy/strlcat functions. Received on Mon Nov 25 13:50:27 2002