Home / Vulnerability Database / C or C++ : Insecure string API
C/C++

C or C++ : Insecure string API

Classification

PCI DSS 4.0
CWE/SANS Top 25 2021

Overview

The string manipulation function used is insecure, since it allows a buffer overflow. Insecure functions include: strcpy, strcat. This may lead to incorrect behavior of the application, crash, or violation of valuable data confidentiality.

The strcpy() function copies the C string pointed by source into the array pointed by destination, including the terminating null character. The strcat appends a copy of the source string to the destination string. It is important to note that, the destination array should be large enough otherwise it may result in undefined behavior.

MEDIUM

DerScanner Severity Score

Do you want to fix C or C++ : Insecure string API in your application?

See also

C/C++

C or C++ : Dead store

C/C++

C or C++ : Use after free

C/C++

C or C++ : va_list uninitialized