[BusyBox] #define -> static const int (last call)

Vladimir N. Oleynik dzo at simtreas.ru
Tue Jan 23 16:04:12 UTC 2001


David Douthitt wrote:
> 
> >       static char *pbuffer
> >       ...
> >       other_func()
> >       {
> >               strcpy(pbuffer, lotsa_chars); 
> >       ...
> >       foo_main()
> >       {
> >               char *buffer[BUFSIZ]; /* declared locally, on stack */
> >               pbuffer = buffer;     /* but available globally */
> >       ...
> 
> Isn't strcpy dangerous, and shouldn't be replaced with strncpy?  I'm
> not a wizard at security (yet :) but I thought strcpy was a risk,
> especially when given user-input data.

Not very required in all place. Previous code must calculate size,
Patch strcpy->strncpy in all only lose speed and size, and
shadow algorithm :)
(This example also have errror, required remove "*" in declare buffer).

In general idea strange, I such used, but then there were computers
without allocate of memory on demand. Now this idea will work only at
STANDALONE_SHELL. But I am afraid, the stack will fast be terminated.



--w
vodz





More information about the busybox mailing list