[ILUG] C being poliltically correct.

[kevin lyda]

On Sun, Mar 14, 2004 at 02:32:35AM +0000, nils wrote:
> Quoted from strcpy man page:
> 
> > If the destination string of a strcpy() is not large enough  (that  is,
> >        if  the programmer was stupid/lazy, and failed to check the size before
> >        copying) then anything might happen.  Overflowing fixed length  strings
> >        is a favourite cracker technique.

> Is there a list of ways to make sure that you are doing the correct
> thing when it comes to writing C/C++ i.e as the above points out, or is
> it just trial and error.You can figure out the simple thing about C/C++
> but when it come to more complex stuff and learning bad habbits can be
> a pain and costly,anyone any idea on what book/website i might look at.

is there any chance that you could wrap your lines at less than 80
chars?

thanks.

the general answer is that you need to think about what you are doing.
in the case of strcpy you need to know that buffers have limited length.

if you do this:

    strcpy(dst, src)

and your code is not sure that dst has at least strlen(src) + 1 bytes,
then you've written bad code.  you need to know how the language you are
using works (in this case how pointers work and how c normally handles
strings) and you need to know the api that you're using (in this case
the lib c api).

kevin

-- 
kevin at ie.suberic.net  ~~  8/1/01 fbi deputy director john o'neill resigned
due to bush's policy on terrorism.  they were told to "back off" their bin
laden and al queda investigations while the bush admin negotiated with the
Taliban.  --~~--~~--~~--~~--~~--~~--~~--~~--  http://www.rememberjohn.com/