Why is strcpy() insecure?

Question

I’m reading about secure programming, and I read that function strcpy(), of the C language, is an example of insecure.

I also read that there is a secure version of this function, which would be the strcpy_s().

What is the functional difference between them? Is it related to accessing improper memory positions? I would like an example to understand the "insecurity" of strcpy().

Answer 1

First it is important to say that it is possible to use this function safely. Her problem is that the programmer may forget or not know how to do this.

The first problem of the function is that it does not consider the size of what it is copying, so it is possible to overwrite an area of memory that was not intended. Usually the memory is allocated where the copy of the string will be placed and then the operation is done. If what is passed to this function is larger than the reserved space, it will put data beyond the reserved space. And this is one of the ways to inject malicious code into an application that wants to commit.

Another problem is that it does not guarantee that the destination will be terminated by a null value \0, which is what determines the end of a string, then another part of the code can read this memory waiting for this character to know when to stop reading and will not find. This problem also exists in the strncpy().

The function strcpy_s() (only available in C11) requires you to pass the size of what will be copied and the function will respect this. Of course, if the programmer doesn’t put a proper value (probably equal to the one allocated) it will also be insecure. It ensures that at the end has a null ending to string adequately.

If you don’t have a C11 compiler, you can use strlcpy(), if available, or strncpy(), that still has problems, but is already a little better. Anyway the programmer can always check before using the function if the size of the source is suitable for target and can ensure that the null is placed at the end. Every decent C programmer has a proper function to do this for him if the compiler he uses does not provide a standard function.

char * txt = malloc(10);
strcpy(txt, "teste maior do que devia"); //aqui já era! Vai ocupar uma memória indevida
strcpy_s(txt, 10, "teste maior do que devia"); //aqui só vai usar "teste mai"

I put in the Github for future reference.