tlaro...@polynum.com writes: > On Tue, Nov 17, 2020 at 10:16:47AM -0500, Greg Troxel wrote: >> >> tlaro...@polynum.com writes: >> >> > But then I realized that I have not changed the offending line: the >> > strcpy() call since there was no overflow problem: it was doing inplace >> > rewrite, suppressing a prefix (doing basename(1) essentially). >> >> Not sure what "inplace" means, but it sounds like it runs afoul of: > > simply something like : strcpy(buf, buf + shift);
That is undefined behavior, and thus wrong and needs to be fixed, fortify or no. >> and thus it is fair to alert on it. > > Yes, but the question was that it alerts only with arrays---but this is > perhaps simply because it would be too costly to call strlen(3) or > equivalent at runtime, and so, when the size is not known at compilation > time, the alert doesn't work. Perfectly ok to have a discussion about how the tool can be improved, but the code is UB and thus an alert is fair, being a member of the set of all behaviors.
signature.asc
Description: PGP signature
