4 ms·
The only thing more dangerous than strcpy is strlcpy or strncpy. I can't tell you how many times I've seen: strncpy(dst, src, sizeof(src)); And the developer
by jazzyb 16y ago
The only thing more dangerous than strcpy is strlcpy or strncpy. I can't tell you how many times I've seen:
strncpy(dst, src, sizeof(src));
And the developer thinks that the code is safer because he's using the "safer" function.
- ot 16y agoI hope you meant strlen in place of sizeof
- Luyt 16y agoor sizeof(dst), and not forgetting dst[sizeof(dst)-1]='\0';
- wladimir 16y agoThat's why strlcpy is safer than strncpy, it makes sure that the destination string will always be zero-terminated.
- jazzyb 16y agoMost people use sizeof when they are copying between static buffers on the stack. Strlen would be just as bad of an idea in this example because they're using the src buffer as the limit on the copy rather than the dst buffer which is still vulnerable to overflow. Should be: strncpy(dst, src, sizeof(dst)-1); Edit: bad code
- __david__ 16y agoI can't see how that would make it more dangerous. It's still not foolproof, but at least it isn't completely braindead like strcpy().