From: Charlie Somerville <charliesome@...>
Date: 2013-10-18T12:34:11-04:00
Subject: [ruby-core:57933] Re: strlen and strnlen in Ruby

--52616303_71c91298_8bb0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On =46riday, 18 October 2013 at 12:03 PM, Edward Ocampo-Gooding wrote:
> Is there a reason why strcpy is used in some places but strncpy in othe=
rs=3F
> =20
> =20


I don't think there's any real convention in the CRuby codebase.
 =20
> (I=E2=80=99ve been dogmatically following the advice of my elders to fa=
vour strncpy whenever possible since it=E2=80=99s easy to run into securi=
ty issues or accidentally feeding a non-null-byte-terminated string in an=
d having the program crash or worse yet, use the result without checking.=
)
> =20
> =20

 =20
Keep in mind strncpy has its own flaws - if the source string is exactly =
the length of the destination buffer, it won't null terminate. =20

Personally I've never really been a fan of strncpy. strcpy is perfectly s=
afe if you know what you're doing. If you don't, you'll probably run into=
 problems with strncpy too.
--52616303_71c91298_8bb0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline


                <div><span style=3D=22color: rgb(160, 160, 168); =22>On =46=
riday, 18 October 2013 at 12:03 PM, Edward Ocampo-Gooding wrote:</span></=
div>
                <blockquote type=3D=22cite=22 style=3D=22border-left-styl=
e:solid;border-width:1px;margin-left:0px;padding-left:10px;=22>
                    <span><div><div><meta http-equiv=3D=22Content-Type=22=
 content=3D=22text/html charset=3Dwindows-1252=22><div>Is there a reason =
why strcpy is used in some places but strncpy in others=3F</div></div></d=
iv></span></blockquote><div><br></div><div>I don't think there's any real=
 convention in the CRuby codebase.</div><div>&nbsp;</div><blockquote type=
=3D=22cite=22 style=3D=22border-left-style:solid;border-width:1px;margin-=
left:0px;padding-left:10px;=22><span><div><div><div>(I=E2=80=99ve been do=
gmatically following the advice of my elders to favour strncpy whenever p=
ossible since it=E2=80=99s easy to run into security issues or accidental=
ly feeding a non-null-byte-terminated string in and having the program cr=
ash or worse yet, use the result without checking.)</div></div></div></sp=
an></blockquote><div>&nbsp;</div><div>
                    Keep in mind strncpy has its own flaws - if the sourc=
e string is exactly the length of the destination buffer, it won't null t=
erminate.
                </div><div><br></div><div>Personally I've never really be=
en a fan of strncpy. strcpy is perfectly safe if you know what you're doi=
ng. If you don't, you'll probably run into problems with strncpy too.</di=
v>
            
--52616303_71c91298_8bb0--