LibTiff Mailing List
TIFF and LibTiff Mailing List Archive
July 2010
Previous Thread
Next Thread
Previous by Thread
Next by Thread
Previous by Date
Next by Date
Contact
The TIFF Mailing List Homepage
This list is run by Frank Warmerdam
Archive maintained by AWare Systems
Thread
2010.07.08 18:03 "Re: strlcpy vs strncpy", by Lee Howard
Bob Friesenhahn wrote: > I see that libtiff is using strncpy() as a safer strcpy() and > strncat() as a safer strcat(). Unfortunately, strncpy() does include > a significant design flaw which causes it still to be insecure unless > additional care is taken. The problem occurs when the string to be > copied exactly matches the buffer size, in which case the string will > lack null termination. The strlcpy() (and strlcat) functions avoid > this glitch by always assuring null termination. The return value of > strl*() are also much more useful since it is easy to test if the > string was truncated (and by how much). > > GraphicsMagick is using strlcpy() and strlcat() for secure string > copies. I will be happy to contribute versions that I wrote myself > for use in libtiff if libtiff choses to rely on these more secure > functions. Libtiff should name the replacement functions differently > in order to avoid any possible conflict/confusion with system provided > versions, or versions from some dependent library or program. I don't have any arguments against this. Thanks, Lee.