RE: safe strcpy()?

On Wed, 29 Jan 2003, Daniel Reed wrote:

> Replacing strcpy()'s with strncpy()'s will not solve all problems,

Replacing strcpy() with strncpy() does NOTHING to fix the destination overflow problem, which is a train wreck waiting to happen.

> Using manipulation routines that ensure the string is large enough

The way to fix this is to just ignore everything that comes in when your buffer is full. Closing the socket is a rather effective, if rude<g> way to let the other side know it's sending you too much!

-- 
Ed Carp, N7EKG          
http://www.pobox.com/~erc               214/986-5870
Licensed Texas Peace Officer
Computer Crime Investigation Consultant

Director, Software Development
Escapade Server-Side Scripting Engine Development Team
http://www.squishedmosquito.com

Microsoft Front Page - the official HTML editor of Al Qaeda
Microsoft Hotmail - the official email of Al Qaeda