Trend Micro: Open source is more secure

TalkBack 44 of 62:

Next »

« Previous

• Thread View
• Flat View

yes...but

Yours will compile to assembly because you are actually changing something. but if re-written the way "whats his name" did it so it actually compiles would not produce any assembly by a good compiler/linker. The last strcpy would just move what's pointed to by fname into whats pointed to by filename so the function does nothing, no assembly or even a call to this function is needed since the result is the 2nd parameter passed. (BTW: strcpy will copy the null terminator from the origin, I understand why you wanted to firewall it but strcpy would blow chunks of fname isn't null terminated anyway) I think a better firewall is to not assume fname is limited to the length of MAX_PATH to begin with.

like so
char* myFunction(char *path, char *fname)
{
char* filename = (char*) malloc(sizeof(char*)*MAX_PATH); //corrected

strcpy(filename, path);
strcpy(filename, "\\"); //corrected
strcpy(filename, fname);

return filename;
}

Posted by: LinuxHippie   Posted on: 06/14/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Server Consolidation and Containment With Virtual Infrastructure VMware To meet the constant demand to deploy, maintain and grow a broad array of ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now