Daniel Stenberg, the creator of the data transfer utility curl, announced the discontinuation of the use of the strcpy() function in the project's codebase and a ban on the function's future application. This decision follows last year's move away from using strncpy(), which copies a specified number of bytes from the input string. The use of strncpy() posed a risk of errors due to the potential omission of the null character at the end of the string or inadvertent zero-padding.
Calls to strncpy() have been replaced with the strcpy() function, which is now preceded by memory allocation for the target buffer based on the size of the source string, or a check to ensure the source string size matches the target buffer. A swap to strlcpy() was not performed because it was necessary to always copy the entire string or return an error.
Now all calls to strcpy() have been replaced with a new function curlx_strcopy(dest, dsize, src, slen). The curlx_strcopy() function requires the sizes of the source and target buffers to be specified, ensuring that the target buffer must be larger than the source to accommodate the null terminator, which is forcibly added by the function at the end to prevent its omission during copying. If the size of the target buffer is greater than zero but insufficient for copying the source string, a null byte is placed at the start. void curlx_strcopy(char *dest, size_t dsize, const char *src, size_t slen) { DEBUGASSERT(slen < dsize); if(slen < dsize) { memcpy(dest, src, slen); dest[slen] = 0; } else if(dsize) dest[0] = 0; }
The replacement of strcpy() with curlx_strcopy() was made due to the possibility of human error, leading to code separation with checks/memory allocation and the call to strcpy(), for example, when carelessly moving only part of the code or inserting code between checks and the call to strcpy(). Moreover, discontinuing the use of strcpy will eliminate the flow of false vulnerability reports arising from incorrect triggers from AI tools that consider the presence of strcpy() a vulnerability without regard to the checks present in the code.
Source: opennet.ru
