Use of insecure unbounded string copy/concatenation functions
ID |
c.buffer_overflow.insecure_api_strcpy_stpcpy_strcat |
Severity |
critical |
Resource |
Buffer Overflow |
Language |
C / C++ |
Description
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
Rationale
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
The following code illustrates a vulnerable pattern detected by this rule:
void copy_append_string(char *string1, char *string2)
{
char buf[BUFSIZE];
// VULNERABLE: Use of insecure unbounded string copy/concatenation functions
strcpy(buf, string1);
// VULNERABLE: Use of insecure unbounded string copy/concatenation functions
strcat(buf, string2);
}