Is memcpy unsafe?
Duplicate:
According to " Please join me in the memcpy () greeting at the Rogues SDL gallery " is memcpy
banned as insecure. Makes sense that gets()
, strcpy
and a similar apis where the size of the assignment is unclear. Is the memmove()
next one?
a source to share
The point is with all these "safe" methods:
Of course, you can easily make the call
memcpy_s()
unsafe by getting the wrong buffer sizes.
[ Source ]
This is why I believe this SDL feature is overblown. Of course, such problems are inherent in a language like C unless the compiler takes any precautions (or appropriate runtime, which would be expensive in terms of performance and / or memory).
It also makes programs less portable, which I personally find a huge disadvantage. Of course, Microsoft won't necessarily agree.
Migrating your C ++ code with proper use of (tested) iterators can make more sense where possible. These operations, as well as inherently unsafe, are more easily used correctly and make incorrect code stand out. Sure, skip emptor and all those C fans and C ++ deniers will be after my skin now ...
a source to share
memmcopy can create an opening for an attacker. For example: A specific flaw exists while processing a malicious WordDocument file. An overflow can be triggered during parsing at offset 0xb4c in the WordDocument stream. At this offset, there is a WORD size that is used as the third parameter to the memmove call.