I'll start with easier example (a bit obfuscated to hide the true origin):
if(strncmp(buf, "action", 6) == 0) { ... }These are two unrelated code snippets from the same program.
strncpy(dst, src, strlen(src));
As I know the author, I have asked him why is he using the 'n' versions of string functions. He argued that it costs him nothing to add the "extra check" to make the code a bit more secure. Not only that the code is not more secure, the extra arguments make it less readable. Plus, there are two additional pitfalls:
- If you change the string in the first line, you have to remember to change its length.
- The second line is effectively just plain old
strcpy
with all its problems. Only that it runs at half the speed ofstrcmp
because of extra length calculation.
strncmp
should look at the actual length of data received over the network into the buf
, and then you should use strncmp
only if there exists a possibility that the string in buf
is not null-terminated. Otherwise, plain strcmp
works just fine. The error in strcpy
is more serious: it should look at the destination buffer length, not the source buffer length.Another practice is concerned with memory allocation and deallocation. I've argued about this with another friend. He maintains that manually deallocating acquired memory before program termination is a good coding practice in all circumstances. I maintain that it is a wasted effort for heap memory acquired by
brk
or mmap
because it is unconditionally deallocated by the OS on program exit.Admittedly, manual memory deallocation on exit might be neccessary under some embedded systems (it was certainly neccessary under DOS!), but the discussion was in the context of UNIX and Windows.
Why is it wasted effort? Because the operating system is much better than the programmer in tracking memory. Memory management is one of the main tasks of the OS. Also, in a larger program, there is no good place to deallocate all memory. There are other people sharing the same opinion. Look for example at this short article.
Friend's counter-argument to this is SYSV SHM, which persists after the program termination. His argument is flawed in a fundamental way: I am arguing that manual memory deallocation is wasted effort only in those cases when it is done by the OS itself. SYSV SHM doesn't fall into that category.
With SYSV SHM you might actually want it to persist in between program runs. One useful application that comes to mind is acting as a cache of most recently used data.
2 comments:
Actually one of the bigger security holes in MySQL was because they were checking the wrong length in strncmp :)
Post a Comment