5 ms·
That's because these are "lessons learned" for how to catch these bugs, instead of "how to write more secure code". Because you can't.
by rfoo 5y ago
That's because these are "lessons learned" for how to catch these bugs, instead of "how to write more secure code".
Because you can't.
- jmull 5y agoYou catch the bug by flagging the use of memcpy instead of something that takes the dest buffer size (like memcpy_s or whatever). It seems to me linters have been flagging this kind of thing since forever. This code is using a wrapper, "PORT_memcpy", so a default ruleset isn't going to flag it. So here I guess no one noticed PORT_memcpy == memcpy (or maybe noticed but didn't take the initiative to add a lint rule or deprecation entry or just created an issue to at least port existing code).
- galangalalgol 5y agowas no one linting the wrapper? the static analysis tools we use wouldn't like memcpy_s either. It would create a finding to use an stl container probably.