advertisement

Article:
  Input Validation in C and C++
Subject:   Broken code given as "secure" examples
Date:   2003-05-28 08:51:34
From:   geppetto
The code in the article for strlcat() is...


size_t strlcat(char *dst, const char *src, size_t len) {
char *dstptr = dst;
size_t dstlen, tocopy;
const char *srcptr = src;


while (tocopy-- && *dstptr) dstptr++;
dstlen = dstptr - dst;


...you might want to actually initialize tocopy.


Also although you're SafeStr string library isn't too bad, you might want to wait for it to go 1.0 before pushing it so heavily ... and you might want to write a couple of tests to make sure it actually works.
Also it seems a bit dubious to mention that strlcpy() isn't available everywhere but yert SafeStr passes printf like calsl to the host implementation which can be based on anyone of a number of standards.
I'd recommend any reader have a look at more than one implementation of a string library (http://www.and.org/vstr/comparison.html), and choose which suits your needs best.

-->