...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h> enum { ARRAY_SIZE = 32 }; void func(void) { char dest[ARRAY_SIZE]; char src[ARRAY_SIZE]; copy(size_t n, char src[n], char dest[n]) { size_t i; for (i = 0; src[i] && (i < sizeof(dest)n); ++i) { dest[i] = src[i]; } dest[i] = '\0'; } |
Compliant Solution (Off-by-One Error)
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h> enum { ARRAY_SIZE = 32 }; void func(void) { char dest[ARRAY_SIZE]; char src[ARRAY_SIZE]; copy(size_t n, char src[n], char dest[n]) { size_t i; for (i = 0; src[i] && (i < sizeof(dest)n - 1); ++i) { dest[i] = src[i]; } dest[i] = '\0'; } |
Noncompliant Code Example (gets())
...
| [Dowd 2006] | Chapter 7, "Program Building Blocks" ("Loop Constructs," pp. 327–336) |
| [Drepper 2006] | Section 2.1.1, "Respecting Memory Bounds" |
| [ISO/IEC 9899:2011] | K.3.5.4.1, "The gets_s Function" |
| [Lai 2006] | |
| [NIST 2006] | SAMATE Reference Dataset Test Case ID 000-000-088 |
| [Seacord 2013b] | Chapter 2, "Strings" |
| [xorl 2009] | FreeBSD-SA-09:11: NTPd Remote Stack Based Buffer Overflows |
...