Re: Security in general (was Re: Proposal "LUID")

From: Kurt Roeckx (Q@ping.be)
Date: Wed Apr 19 2000 - 11:29:30 EST


On Wed, Apr 19, 2000 at 12:09:14PM -0400, willy@thepuffingroup.com wrote:
> On Wed, Apr 19, 2000 at 10:03:46AM -0400, Horst von Brand wrote:
> > strncpy(3) and its ilk instead of strcpy(3) et al is standard
> > recomendation, take a look at the Secure-Programs-HOWTO for instance.
>
> strncpy Considered Harmful. use strlen and memcpy instead. it's faster
> and gives you more useful information.

I did some tests once, but can't remember the exact results.

I do remember that it all depends on how long the string to be copied is,
and how big the buffer is. If my memory is any good, strncpy was alot
faster then doing strlen + memcpy on larger strings.
Can't remember where one was faster then the other, but that number wasn't
that big

Remember that strlen + memcpy has to go twice over the string.

I think doing a memcpy with the size of the buffer (no strlen) had simular
speeds then just doing strncpy.

Feel free to prove me wrong.

> (the number of people who don't realise than strncpy zero-fills is
> amazingly high. Oh and that it doesn't necessarily give you a string
> as the result..)

I do know that it is padded with NUL's. And in some cases that might even
be a wanted side effect.
Everybody (should) know that you have to make sure you terminate your
string if you use strncpy. Some people use some simple marco for it.

Kurt

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sun Apr 23 2000 - 21:00:15 EST