Without an understanding of the underlying language, one problem you may have is understanding context.
While it may be best practice to eschew these banned functions completely, I see a lot of projects where some of these functions are used, but in safe contexts. If you raise a red flag simply every time you see one of these functions in use, you may have a bad time.
Here are some examples using the infamous strcpy and its slightly safer version strncpy:
void foo_1(char* bar) {
char buf[100];
strcpy(buf, bar);
puts(buf);
}
char* foo_2(char* bar) {
char* buf = NULL;
buf = malloc(strlen(bar)+1);
strcpy(buf, bar);
return buf; // freed later
}
void foo_3(char* bar) {
char buf[100];
strncpy(buf, bar, sizeof(buf));
puts(buf);
}
void foo_4() {
char buf[100];
strcpy(buf, "This is just an example.");
puts(buf);
}
If I did this correctly, these examples should be:
- Unsafe (if
bar is longer than 100 bytes, an overflow will occur)
- Safe (buffer is created large enough)
- Unsafe (produces un-terminated string when there are no null bytes in first n bytes of
bar)
- Safe (string is constant and smaller than buffer size)
From the strcpy manpage:
If the programmer knows (i.e., includes code to test!) that the size
of dest is greater than the length of src, then strcpy() can be used.
If these examples are challenging, you may want to brush up on your C programming, as these are by no means complex examples.
Additionally, while the "strn" family functions also may appear on the banned list, many projects use these safely as well by forcing a null byte at the end, often done with a wrapper function.
