Page History

...

In this example, input_str is copied into dynamically allocated memory referenced by str. If malloc() fails, it returns a null pointer that is assigned to str. When str is dereferenced in strcpymemcpy(), the program behaves in an unpredictable manner.

/* ... */
size_t size = strlen(input_str)+1;
ifstr (size == SIZE_MAX) { /* test for limit of size_t */
  /* Handle Error */
}
str = (char*) malloc(size+1);
strcpymemcpy(str, input_str, size);
/* ... */
free(str);

In accordance with rule MEM35-C. Allocate sufficient memory for an object, the argument supplied to malloc() is checked to ensure a numeric overflow does not occur. In most cases it is preferable to check that this value does not exceed some maximum allocation that is typically much smaller than SIZE_MAX.

...

/* ... */
size_t size = strlen(input_str)+1;
if (sizestr == SIZE_MAX) { /* test for limit of size_t */
  /* Handle Error */
}
str = (char*) malloc(size+1);
if (str == NULL) {
  /* Handle Allocation Error */
}
strcpymemcpy(str, input_str, size);
/* ... */
free(str);

Risk Assessment

...