3 ms·

I'd just like to see a concrete example for once.

• coldtea 7y ago
  Like, apart from tons of well known bugs, and vulnerabilities caused from string manipulation? How exactly did you miss news items, reports, posts, university lectures, books, and even your own personal experience, on them? Or is the insinuation that we are hand-wavy about it, and you doubt the existence and scale of the problem? It's a well researched, well established problem, known for almost half a century. https://en.wikipedia.org/wiki/C_standard_library#Buffer_overflow_vulnerabilities https://en.wikipedia.org/wiki/C_standard_library#Buffer_over... https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml https://security.web.cern.ch/security/recommendations/en/cod... http://www.informit.com/articles/article.aspx?p=430402&seqNum=2 http://www.informit.com/articles/article.aspx?p=430402&seqNu... https://randomascii.wordpress.com/2013/04/03/stop-using-strncpy-already/ https://randomascii.wordpress.com/2013/04/03/stop-using-strn... https://courses.cs.washington.edu/courses/cse341/04wi/lectures/26-unsafe-languages.html https://courses.cs.washington.edu/courses/cse341/04wi/lectur... (null termination) https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not-safe-to-use/ https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not... https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Overruns_and_Overflows#.E2.80.98Vanilla.E2.80.99_buffer_overflow https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Ov...: And let's not even get into format string issues...