strlcpy

From Wikipedia, the free encyclopedia

In computer programming, the strlcpy function is intended to replace the function strcpy and provide a simpler and more robust and secure interface than strncpy. It is designed to copy the contents of a string from a source string to a destination string.

strlcpy and related functions were developed by Todd C. Miller and Theo de Raadt and first implemented in OpenBSD 2.4. They are not standardised C library functions, but are common in Berkeley Software Distribution-derived operating systems.

Contents 1 Usage 2 History 3 Reception 4 References 5 External links

[edit] Usage

   size_t strlcpy(char *destination, const char *source, size_t size);

strlcpy offers two features that are designed to help software developers avoid problems. The function takes the size of the destination as a parameter, making buffer overflows impossible (provided the size parameter is correct). If this size is greater than zero, a nul byte is always written to the destination, so the resulting string is always nul-terminated (even if the source string was truncated to fit). For performance reasons, strlcpy does not fill any unused space in a destination string with zeros, unlike strncpy.^[1] Additionally, strlcpy returns the length of the source string, which can be compared to size to check for truncation, for example:

   if (strlcpy(dest, source, dest_len) >= dest_len)
       errx(1, "String too long");

[edit] History

strlcpy was first introduced with OpenBSD version 2.4. It has subsequently been adopted by a number of operating systems including FreeBSD (from version 3.3), Solaris and Mac OS X. Many application packages and libraries include their own copies of these functions, including glib, rsync and the Linux kernel itself.

Similarly, there is a variant of strcat, called strlcat.

[edit] Reception

Red Hat developers Ulrich Drepper and James Antill are critics of the strlcpy and strlcat functions.^[2] Antill notes that they are non-standard and that there are implementation differences between the BSD and Solaris implementations (the return value of strlcat when there is no nul in the destination buffer).^[3] Antill also expressed concern regarding the risks of truncation when using any string function involving static allocation.^[4] Drepper argues that strlcpy and strlcat make truncation errors easier for a programmer to ignore and thus can introduce more bugs than they remove;^[2] consequently, these functions have not been added to the GNU C Library.

[edit] References

1. ^ Todd C. Miller; Todd Theo de Raadt (1999). "strlcpy and strlcat - consistent, safe, string copy and concatenation.". USENIX '99. http://www.gratisoft.us/todd/papers/strlcpy.html. 
2. ^ ^{a b} libc-alpha mailing list, selected messages from 8 August 2000 thread: 53, 60, 61
3. ^ Antill, James. Security with string APIs
4. ^ Antill, James.Security with string APIs: Security relevant things to look for in a string library API

[edit] External links

• strlcpy and strlcat--Consistent, Safe, String Copy and Concatenation - a paper written by Miller and de Raadt, presented at Usenix 99
• strlcpy(3): size-bounded string copying and concatenation – OpenBSD Library Functions Manual
• strlcpy() source
• strlcat() source
• Linux Weekly News discussion of strlcpy
• Developer Blog discussion of strlcpy and mempcpy