SECURE_CODING 概要 zz

最新推荐文章于 2024-08-12 22:17:57 发布

转载最新推荐文章于 2024-08-12 22:17:57 发布 · 891 阅读

文章标签：

#buffer #string #function

本文总结了安全编程中的常见问题，特别是使用strcpy、sprintf、strcat等函数可能导致缓冲区溢出的风险，并提供了安全替代方案。

以下总结的内容来自于Coverity Prevent分析，SECURE_CODING 是Prevent中关于编码安全方面的一个检查器，是全球百万余开发人员从历史上的各种安全漏洞事件中总结出来的。

× [VERY RISKY]. Use of "strcpy" has been known to cause a buffer overflow when used incorrectly. If the destination string of a strcpy() is not large enough then anything might happen. Use strncpy() instead

×[VERY RISKY]. Use of "sprintf" has been known to cause a buffer overflow when used incorrectly. Because sprintf() assumes an arbitrarily long string, callers must be careful not to overflow the actual space of the destination. Use snprintf() instead, or correct precision specifiers.

×[VERY RISKY]. Use of "strcat" has been known to cause a buffer overflow when used incorrectly. The destination of a strcat() call must have enough space to accept the source. Use strncat() instead.

×You should never use the gets() function because you cannot control the amount of data that is read.

From: http://www.51testing.com/?uid-10851-action-viewspace-itemid-106174