Re: [AD] strcat strcpy etc.. BUG found!

[Robert Ohannessian <ohannessian@xxxxxxxxxx>]

Lo'oRiS il Kabukimono wrote:
> Eric Botcazou <ebotcazou@xxxxxxxxxx> :
>
>
> > 7.15.3.2  The strncat function
>
> [...]
>
> and... what's wrong with that?
> to me this looks like the same good old strncat...

char buf[256];

strncpy(buf, "foo", 256);
strncat(buf, bar, 256);

strncat can crash for two reasons:
- the strncpy call didn't insert the terminating 0
- strncat may write to buf[256], which will cause it to crash.

The "fixed" code is:

char buf[256];

strncpy(buf, "foo", 256);
buf[MIN(strlen("foo"), 256)] = 0;  // add missing 0
strncat(buf, bar, 256 - 1);        // amke sure not to write extra 
character.



--
- Robert Jr Ohannessian
http://bob.allegronetwork.com/
The peer will come and reset your connection. RUN WHILE YOU STILL CAN!