Thread: Security Engineering; Simple Question

Hey, guys,


I am absolutely new to C programming. Currently I am preparing for my new course of studies IT Security. In a slightly older exam I found a task where I have no approach how to solve it. The task is in German. In principle it is about finding critical errors.
It is not written how the passed parameters look like. I have come to the point that you should not use strcpy() because it has no bounds checking. Also char[10] should not be used if you want to store 10 characters (\0). Can someone help me a little bit? I would like to mention again that you help me here personally and do not help to collect bonus points in the university.




Thank you !

Can you use `strncpy`?

And why are you doing math on a string?

Problems with this code:
1. your buffer (code) has obly 10 chars (as you notice) and 11 bytes are being copied;
2 '9' (value: 57) is not the same thing as 9;
3. argv[1] could have less then 10 chars

I don't know german, so I cannot know what is being asked.

Another one: printf() should have the format string in line 5, as in:

Code:

  printf( "%s", argv[1] );