Students uncover dozens of Unix software flaws (News.com)

Students uncover dozens of Unix software flaws (News.com)

Posted Dec 17, 2004 20:35 UTC (Fri) by sdalley (subscriber, #18550)
In reply to: Students uncover dozens of Unix software flaws (News.com) by JoeBuck
Parent article: Students uncover dozens of Unix software flaws (News.com)

> Reading a line into a fixed-sized buffer is the problem,
> and use of strl* functions to get rid of the buffer overrun
> is only a band-aid.

Well, yes, but only if you use it rather mindlessly without checking the return value. If this compares greater than the len parameter then you know immediately that the result is truncated.

In the case where you expect meaningful strings to be relatively short and longer ones to be erroneous, strl* functions are ideal and it makes perfect sense to have fixed-sized buffers. In the case where strings of arbitrary length are meaningful, you obviously want a fully dynamic solution such as asprintf and friends - see http://www.mibsoftware.com/libmib/astring/ .

---

(Log in to post comments)