Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace strcpy and strcat with safer alternatives in C-code on Android #5253

Open
2 tasks done
Jacalz opened this issue Nov 12, 2024 · 1 comment
Open
2 tasks done
Labels
enhancement New feature or request OS:Android Tickets affecting only Android devices

Comments

@Jacalz
Copy link
Member

Jacalz commented Nov 12, 2024

Checklist

  • I have searched the issue tracker for open issues that relate to the same feature, before opening a new one.
  • This issue only relates to a single feature. I will open new issues for any other features.

Is your feature request related to a problem?

The functions strcpy and strcat are generally regarded as unsafe as they do not check the length of the buffer they are writing into. I don't know if the current uses in https://github.com/search?q=repo%3Afyne-io%2Ffyne%20strcpy&type=code and https://github.com/search?q=repo%3Afyne-io%2Ffyne%20strcpy&type=code can be abused in any way (I couldn't see something strange at first glance) but it does not hurt to stay on the safe side.

We should try to replace these with strlcpy and strlcat respectfully assuming that they exist.

Is it possible to construct a solution with the existing API?

Yes, assuming that the improved APIs exist in the Android c-library.

Describe the solution you'd like to see.

Replace functions with strlcat and strlcpy to avoid potential issues with writing outside of buffers.

@Jacalz Jacalz added enhancement New feature or request OS:Android Tickets affecting only Android devices labels Nov 12, 2024
@Jacalz
Copy link
Member Author

Jacalz commented Nov 14, 2024

We should likely also replace strdup with strndup for extra safety: https://github.com/search?q=repo%3Afyne-io%2Ffyne+strdup&type=code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request OS:Android Tickets affecting only Android devices
Projects
None yet
Development

No branches or pull requests

1 participant