Problem - Kevin Tafuro

the buffer is heap-allocated (that is, it is allocated with malloc() or new(), a buffer
overflow can be security-critical if an attacker can write over critical data that happens
to be in nearby memory.
The problem with this function is that, no matter how big the buffer is, an attacker
can always stick more data into the buffer than it is designed to hold, simply by
avoiding the newline.
There are plenty of other places where it is easy to overflow strings. Pretty much any
time you perform an operation that writes to a “string,” there is room for a problem.
One famous example is strcpy( ):
char *strcpy(char *dst, const char *src);
This function copies bytes from the address indicated by src into the buffer pointed
to by dst, up to and including the first NULL byte in src. Then it returns dst. No effort
is made to ensure that the dst buffer is big enough to hold the contents of the src
buffer. Because the language does not track allocated sizes, there is no way for the
function to do so.
To help alleviate the problems with functions like strcpy( ) that have no way of
determining whether the destination buffer is big enough to hold the result from
their respective operations, there are also functions like strncpy( ):
char *strncpy(char *dst, const char *src, size_t len);
The strncpy( ) function is certainly an improvement over strcpy( ), but there are still
problems with it. Most notably, if the source buffer contains more data than the limit
imposed by the len argument, the destination buffer will not be NULL-terminated.
This means the programmer must ensure the destination buffer is NULL-terminated.
Unfortunately, the programmer often forgets to do so; there are two reasons for this
failure:
• It’s an additional step for what should be a simple operation.
• Many programmers do not realize that the destination buffer may not be NULLterminated.
The problems with strncpy( ) are further complicated by the fact that a similar function,
strncat( ), treats its length-limiting argument in a completely different manner.
The difference in behavior serves only to confuse programmers, and more often than
not, mistakes are made. Certainly, we recommend using strncpy( ) over using
strcpy( ); however, there are better solutions.
OpenBSD 2.4 introduced two new functions, strlcpy( ) and strlcat( ), that are consistent
in their behavior, and they provide an indication back to the caller of how
much space in the destination buffer would be required to successfully complete their
respective operations without truncating the results. For both functions, the length
limit indicates the maximum size of the destination buffer, and the destination buffer
is always NULL-terminated, even if the destination buffer must be truncated.
80 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.