Are there any free implementations of strcpy_s and/or TR24731-1?

c string security cross-platform tr24731
Mark picture Mark · Apr 9, 2012 · Viewed 12.7k times · Source

I have an old project that is mixed C and C++. It makes extensive use of C strings and of strcpy,strcat,strncpy,strncat etc. I've uncovered a number of buffer overflows, and I'd like to use more secure functions, such as strcpy_s. MSVC includes those functions, but I need something that will work on various platforms - linux, osx, and windows at the least.

I do know of strlcpy, but as plenty of people have noted (example), it really isn't an improvement.

So: Are there any free implementations of strcpy_s, strcat_s, etc, or of the entire TR24731-1?

I need something that's either public domain or BSD, but if you know of implementations under other licenses, go ahead and list them - I'm sure someone else will benefit.

Answer

Óscar López picture Óscar López · Apr 9, 2012

Try with the Safe C library. It's under the MIT license and according to this list implements the functions you're looking for:

The Safe C Library provides bound checking memory and string functions per ISO/IEC TR24731. These functions are alternative functions to the existing standard C library that promote safer, more secure programming

Related questions

C - The %x format specifier

I have a small question. I know that the %x format specifier can be used to read values from the stack in a format string attack. I found the following code: %08x%08x%08x%08x What does the 08 mean? What …

Read More
How to write value into an address in format string attack

I'm taking a security course which needs us to do format string attack on an unix virtual machine. The vulnerability is a format string using command line argument. My question is how can I write value into an address in …

Read More
How do I concatenate const/literal strings in C?

I'm working in C, and I have to concatenate a few things. Right now I have this: message = strcat("TEXT ", var); message2 = strcat(strcat("TEXT ", foo), strcat(" TEXT ", bar)); Now if you have experience in C I'm sure you realize …

Read More