Re: safe strcpy()?

From: Crispin Cowan (crispin@wirex.com)
Date: 01/28/03

  • Next message: Brian Reichert: "Re: Can System() of Perl be bypassed?" 
    Date: Tue, 28 Jan 2003 14:49:45 -0800
From: Crispin Cowan <crispin@wirex.com>
To: Michal Zalewski <lcamtuf@coredump.cx>

    Michal Zalewski wrote:

    >[encoding buffer size with the buffer]
    >
    >
    >I'm pretty convinced I've seen at least a discussion about such an
    >implementation, quite unfortunately, I can't find any references right
    >now. Perhaps other readers could help.
    >
    Not sure if this is what you're referring to ... DJB (Dan Bernstein)
    built a string manipulation library as part of his qmail implementation.
    This string library *completely* disposes of C's null-terminated string
    idiom in favor of strings being an object that contains base and bounds
    information. This has the advantage of being much safer (strcpy really
    does know the destination size, and will not overflow it) and the
    disadvantage of being more-or-less completely incompatible with current
    C code.

    Crispin 

    -- 
Crispin Cowan, Ph.D.
Chief Scientist, WireX                      http://wirex.com/~crispin/
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html
			    Just say ".Nyet"

    Relevant Pages

    • Re: Getting file name from the file path error
      ... I checked one users tools - References and it appears that it ... It is part of a code module in an Excel ... end of statement with the As highlighted after the(stFullName As String). ... Sub GetFileNameAs String ...
      (microsoft.public.excel.programming)
    • Re: accessors
      ... mentioned that returning references from functions makes using ... boundaries, but if i did, "string const& nameconst" is functionally ... the same as "string nameconst", so i don't see why i'd have to change ... anything (but if i did, the change does not really affect client code, ...
      (comp.lang.cpp)
    • Re: Importing Excel
      ... Function LastInStr(strSearched As String, strSought As String) As Integer ... Didn't realize you haven't set references yet. ... > named Microsoft Excel and select the box. ...
      (comp.databases.ms-access)
    • Re: Is garbage collection here yet?
      ... I don't consider tcl to be a fully higher-level language. ... Tcl has so many other cool features and such a clean ... As others have answered, Tcl does do ref-counting GC of its values, which works fine for strings as they can't contain circular references and are stateless/immutable. ... Basically, it's hard to distinguish a reference from any other string, which makes it difficult to know when it is safe to delete something. ...
      (comp.lang.tcl)
    • Suggestions for refactoring unusual tables
      ... id (int, primary key) ... systext (string) ... catalog_id ... type_id (int, references catalog_entry) ...
      (comp.databases)