romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 21:03:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

curlx: curlx_strcopy() instead of strcpy()

Browse source 
This function REQUIRES the size of the target buffer as well as the
length of the source string. Meant to make it harder to do a bad
strcpy().

Removes 23 calls to strcpy().

Closes #20067
This commit is contained in:
Daniel Stenberg 2025-12-21 23:40:24 +01:00
parent f099c2ca55
commit a535be4ea0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
30 changed files with 195 additions and 97 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vtls/openssl.c
View file

@ -61,6 +61,7 @@
#include "../multiif.h"
#include "../curlx/strerr.h"
#include "../curlx/strparse.h"
#include "../curlx/strcopy.h"
#include "../strdup.h"
#include "apple.h"
@ -773,8 +774,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
if(!*buf) {
const char *msg = error ? "Unknown error" : "No error";
if(strlen(msg) < size)
strcpy(buf, msg);
curlx_strcopy(buf, size, msg, strlen(msg));
}
return buf;

6
lib/vtls/vtls.c
View file

@ -72,6 +72,7 @@
#include "../select.h"
#include "../setopt.h"
#include "../strdup.h"
#include "../curlx/strcopy.h"
#ifdef USE_APPLE_SECTRUST
#include <Security/Security.h>
@ -1082,10 +1083,7 @@ static size_t multissl_version(char *buffer, size_t size)
}
if(size) {
if(backends_len < size)
strcpy(buffer, backends);
else
*buffer = 0; /* did not fit */
curlx_strcopy(buffer, size, backends, backends_len);
}
return 0;
}

4
lib/vtls/wolfssl.c
View file

@ -62,6 +62,7 @@
#include "../connect.h" /* for the connect timeout */
#include "../progress.h"
#include "../strdup.h"
#include "../curlx/strcopy.h"
#include "x509asn1.h"
#include <wolfssl/ssl.h>
@ -1542,8 +1543,7 @@ static char *wssl_strerror(unsigned long error, char *buf, unsigned long size)
if(!*buf) {
const char *msg = error ? "Unknown error" : "No error";
/* the string fits because the assert above assures this */
strcpy(buf, msg);
curlx_strcopy(buf, size, msg, strlen(msg));
}
return buf;