Re: C++ Compiler with a -Wwarn-use-of-strcpy or similar option??

  "Paul Sheer" <psheer@WITHOUTicon.co.za> wrote:
> I need to automatically search and replace all fixed size
> buffer strcpy's with strncpy's (or better yet, strlcpy's)
> as a security and stability audit. The code base is large
> and it is not feasable to manually perform these changes.


1. Replacing strcpy with strncpy is a very bad idea. Where strcpy
overwrites memory, strncpy will create char arrays that are not C
strings.


2. If you perform these changes automatically using some tool then
security will go _down_. Of course, if your intention is only to make
management happy and have a check on a checklist, fine. If you want your
software to be secure and stable, do it by hand.


My recommendation: Take the whole source code. Give it to two separate
programmers. Let them discuss very carefully between them how to make
changes. Then each one goes ahead and makes the necessary changes. When
they are done, you compare the results and clean up any differences.


This is the fastest and safest method to actually get a safer and more
stable program.

Return to the comp.compilers page.
Search the comp.compilers archives again.