Skip to content

Insecure string processing functions

Description

The `strccpy` and `strcadd` functions do not allow the caller to check that the destination size of the buffer will fit the input buffer prior to copying.

Examples

Insecure Code

c
strccpy(dest, src);

Secure Code

c
strncpy(dest, src, sizeof(dest));

Remediation

Use safer string processing functions like `strncpy` or `strcpy_s` that allow specifying the maximum number of characters to copy.

Rule Details

FieldValue
IDCODE-0578
CategoryInjection
SeverityHIGH
CWECWE-120
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagsinsecure-function, buffer-overflow
OWASPA1:2017-Injection, A03:2021-Injection