Hi all,

>
> Same problem; not safe anyway. (sizeof (dst) - strlen(dst) - 1, if anything)
>

Another thing to use is consistency, for example,

char dst[50];
strncpy(dst, user_supplied_data, sizeof(dst));
strncat(dst, sizeof(dst) - strlen(dst) -1, moreuserdata);

This could be exploitable if user_supplied_data is 50 or more bytes long.

In specific,

50 - 50 - 1 == -1

Since strncat's len parameter is size_t (which is unsigned), strncat is
willing to append _way_ to many bytes. IIRC, some fingerd's had this
problem (possibly some identd, *shrug*).

Similar things can be done to snprintf and so on. A wrapper around those
library calls could be used to check if its unsigned (and wouldn't
have that much drawback, because I can't think of anything that'd do a
>2G string operation normally), by using int as opposed to size_t.

I guess this comes to the class of integer over/under flows now :)

Sincerely,
Andrew Griffiths

[ reply ]