Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace strncpy with strlcpy #2783

Open
philipphofmann opened this issue Mar 13, 2023 · 3 comments · May be fixed by #4636
Open

Replace strncpy with strlcpy #2783

philipphofmann opened this issue Mar 13, 2023 · 3 comments · May be fixed by #4636
Assignees
@philprime
Labels
Platform: Cocoa

Comments

@philipphofmann
Copy link
Member

philipphofmann commented Mar 13, 2023 •
edited
Loading

Description

Our codebase uses strncpy, which is unsafe according to the Apple Secure Coding Guide. We should replace it with strlcpy. Worth investigating if KSCrash has already fixed this.

If we can simply replace strncpy with strlcpy, cause the code has test coverage we should do this quickly. If replacing is a bit complicated, needs refactoring to make things testable, we should reconsider the priority.

Related security issue: CWE-676.
@philipphofmann philipphofmann mentioned this issue Mar 13, 2023
Open
4 tasks
@philipphofmann philipphofmann moved this from Needs Discussion to Blocked in Mobile & Cross Platform SDK Mar 15, 2023
@brustolin brustolin moved this from Blocked to Backlog in Mobile & Cross Platform SDK Mar 22, 2023
@github-actions
Copy link

github-actions bot commented Apr 6, 2023

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

@philprime philprime self-assigned this Dec 13, 2024
@philprime philprime moved this from Backlog to In Progress in Mobile & Cross Platform SDK Dec 13, 2024
@philprime philprime linked a pull request Dec 13, 2024 that will close this issue
Draft
11 tasks
@armcknight
Copy link
Member

We should look at Bugsnag instead of KSCrash, as the former is built on top of the latter (and by the same author), which isn't really maintained any longer.

Here are the usages of strncpy in bugsnag:
Image
and that wrapper function is only called in one place: Image

and strlcpy:
Image

@philipphofmann
Copy link
Member Author

@armcknight, FYI, there has been some activity on https://github.com/kstenerud/KSCrash in the last couple of months.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@philprime philprime

Labels
Platform: Cocoa
Projects
Mobile & Cross Platform SDK
Status: In Progress
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: replace occurences of strncpy to strlcpy getsentry/sentry-cocoa
5 participants
@kahest @philipphofmann @armcknight @hubertdeng123 @philprime