Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace unsafe C functions like strcpy with safer alternatives #556

Open
narskidan opened this issue Nov 17, 2023 · 1 comment · May be fixed by #557
Open

Replace unsafe C functions like strcpy with safer alternatives #556

narskidan opened this issue Nov 17, 2023 · 1 comment · May be fixed by #557

Comments

@narskidan
Copy link

Inspired by urbit/archaeology#71, there are numerous calls to strcpy(), sprintf(), and other "unsafe" functions. Many of these are harmless...but a few actually seem feasibly exploitable! Kinda!

In any case, in my fork (https://github.com/darighost/vere) I replaced all of the calls to strcpy(), sprintf() with calls to snprintf instead. It's also possible I'm breaking a bunch of stuff without realizing. My fork compiles and I ran it and did Urbit stuff but who knows, there's an infinite amount of behavior I didn't test so yeah.

If this is desired, I'd also like to replace some other functions as well. But I wanted to check, is this even a change you guys want? Also, I'm using this as a chance to "practice" contributing to this repo, so please let me know if I should be doing something differently.

Thanks!

PS: I know, I know, we're all awaiting Ares with bated breath. What can I say. I also like PHP and Visual Basic 5, sue me.

@joemfb
Copy link
Member

joemfb commented Nov 17, 2023

@darighost such a PR would be welcome, we shouldn't be using the unchecked versions of those string functions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants