Re:Beware of strncpy and strncat
by loeg on Wednesday June 06, 2018 @05:24PM
(#17251254)
Sure, that's a good point.
However, while it may also be possible, in some code, for a malicious user to control the buffer size, the int precision argument, as used in this construct, derives from the buffer size, and not the input string.
If the user can control the buffer size, then yes, we get the very undesireable buffer overflow via overflow from positive to negative[0]:
A negative precision is taken as if the precision were
omitted.
However, while it may also be possible, in some code, for a malicious user to control the buffer size, the int precision argument, as used in this construct, derives from the buffer size, and not the input string.
If the user can control the buffer size, then yes, we get the very undesireable buffer overflow via overflow from positive to negative[0]:
[0]: snprintf(3) man page from linux