Daniel Stenberg, a developer of the network data transfer utility curl, announced the discontinuation of the use of the strcpy() function in the project’s codebase and prohibited its use in the future. This decision follows the abandonment of the strncpy() function last year, which copies a specified number of bytes from the input string. Using strncpy() posed a risk of errors due to the potential omission of the null character at the end of the string or the addition of zero padding.
Calls to strncpy() were replaced with the strcpy() function, which required memory allocation for the target buffer considering the size of the source string, or there was a check to ensure that the size of the source string matched the target buffer. A replacement with the strlcpy() function was not made as it was necessary to always copy the entire string or return an error.
Now all calls to strcpy() have been replaced with the new function curlx_strcopy(dest, dsize, src, slen). The curlx_strcopy() function requires specifying the size of the source and target buffers, with the understanding that the target buffer must be larger than the source to accommodate the null character at the end of the string, which is forcibly added by the function to prevent its omission during copying. If the size of the target buffer is greater than zero but insufficient for copying the target string, a null byte is added at the beginning. void curlx_strcopy(char *dest, size_t dsize, const char *src, size_t slen) { DEBUGASSERT(slen < dsize); if(slen < dsize) { memcpy(dest, src, slen); dest[slen] = 0; } else if(dsize) dest[0] = 0; }
The replacement of strcpy() with curlx_strcopy() was made due to the possibility of human error leading to separation of code with checks/memory allocation and calls to strcpy(), for instance, with careless transfer of only part of the code or insertion of code between the check and the call to strcpy(). Additionally, discontinuing the use of strcpy allows the elimination of a stream of false vulnerability reports due to incorrect triggers from AI tools, which consider the presence of strcpy() a vulnerability without accounting for existing checks in the code.
Forrás: opennet.ru
