OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Vuln-Dev Archives: Re: Secure coding in C (was Re: Administrivi

Re: Secure coding in C (was Re: Administrivia #4883)

Subject: Re: Secure coding in C (was Re: Administrivia #4883)
From: Blue Boar (BlueBoarTHIEVCO.COM)
Date: Sun Jan 16 2000 - 00:03:28 CST

Bennett Todd wrote:
>
> char *a = something();
> char *b = something_else();
> int len = strlen(a) + strlen(b);
> char *c = malloc(len + 1) || die("malloc");
> (void) strcat(strcpy(c, a), b);

If you have any reasonable idea what a maximum size for a or b might
be, then this could be better. As it is, if I'm trying to DoS you
but sending huge strings, you've made it that much easier by doubling
the amount of RAM needed. Since you're limiting yourself to MAXINT
anyway, you should check that against the sizes of a and b before
you malloc.

OTOH, since you mentioned this is a mail app... if those variables
represent the body of the message, you have no real choice.

                                        BB

This archive was generated by hypermail 2b27 : Sun Jan 16 2000 - 00:11:44 CST