Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert to static array sizes for string parameters - name[static SIZE] and scrub string handling #1511

Open
skliper opened this issue May 13, 2021 · 1 comment

Comments

@skliper
Copy link
Contributor

skliper commented May 13, 2021

Is your feature request related to a problem? Please describe.
Many APIs and even internal functions require specific minimum string sizes to avoid a potential buffer overrun, yet take simple pointers, i.e. char *. Some tools complain about strcpy/sprintf/etc, but the sized versions aren't any safer if the passed in string is too short.

Example case:

void CFE_TBL_FormTableName(char *FullTblName, const char *TblName, CFE_ES_AppId_t ThisAppId)
{
char AppName[OS_MAX_API_NAME];
CFE_ES_GetAppName(AppName, ThisAppId, sizeof(AppName));
/* Ensure that AppName is null terminated */
AppName[OS_MAX_API_NAME - 1] = '\0';
/* Complete formation of processor specific table name */
sprintf(FullTblName, "%s.%s", AppName, TblName);

Describe the solution you'd like
Leverage C99 checks on sized parameter arrays, which also will protect at compile time from NULL inputs. Once minimum sizes are guaranteed, then revisit string comparison/manipulation calls to avoid buffer overruns based on these enforced minimums.

Note not backwards compatible where pointers are passed in vs the array. Also would REQUIRE the removal of all NULL pointer test cases and checks (would cause compile errors or dead code respectively).

Describe alternatives you've considered
None

Additional context
Code review, related to #1465

Requester Info
Jacob Hageman - NASA/GSFC

@skliper
Copy link
Contributor Author

skliper commented May 13, 2021

Should actually confirm all our supported compilers are compliant (check NULL and undersized arrays) before advancing this change. At minimum the one used for CI should confirm the core software as configured is good.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant