Page History

...

Non-Compliant Code Example

In this non-compliant code example, the programmer sets the value of the msg variable, expecting to reuse it outside the block. Due to the reuse of the variable name, however, the outside msg variable value is not changed.

char msg[100];
/* ... */
void helloerror_message(char *error_msg) {
  char msg[80] = "Hello";
  strcpy(msg, "Error");
}
;
  /* ... */
  strcpy(msg, err_msg);  /* error_msg is assumed to reference a NTBS of len 99 or less */
  return;
}

Furthermore, if the length of the null-terminated byte string referenced by error_msg is greater than 79 characters in length, a buffer overflow will occur on the stack, which may be exploitable.

Non-Compliant Code Example

In this non-compliant code example, the call to {{strpcy()}} has been replaced with a call to {{strcpy_s()}}.  See \[[STR00-A. Use TR 24731 for remediation of existing string manipulation code]].

char msg[100];
/* ... */
void error_message(char *error_msg) {
  char msg[80];
  /* ... */

  /* error_msg is assumed to reference a NTBS of length 99 or less */
  errno_t e = strcpy_s(msg, sizeof(msg), error_msg);
  if (e != 0) {
     /* handle strcpy_s() error */
  }
}

This code fixes one of the two problems from the previous non-compliant code example: it eliminates the possibility of buffer overflow because two references to msg in strcpy_s() both refer to msg80 defined in the subscope. The initial problem of not changing the value of the outside msg variable value remains. The call to strcpy_s() will also fail if the length of the null-terminated byte string referenced by error_msg is longer than 79 characters in length.

Compliant Solution

This compliant solution uses different, more descriptive variable names. Also it uses strcpy_s().

char error_msg[100];
/* ... */
void helloerror_message(char *error_msg) {
  char hellodefault_msg[80] = "Hello";
  ;
  /* ... */

  /* error_msg is assumed to reference a NTBS of length 99 or less */  errno_t e = strcpy_s(error_msg, 100, "Error");
  /* .. handle e - the value returned byif (e != 0) {
     /* handle strcpy_s() error */
  }
}

When the block is small, the danger of reusing variable names is mitigated by the visibility of the immediate declaration. Even in this case, however, variable name reuse is not desirable.

...