SV.BANNED.REQUIRED.COPY

Banned copy function call

There are a number of C/C++ functions that are not considered secure, and are known as 'banned' for that reason. These functions are:

  • memory allocation functions like alloca
  • string concatenation functions like strcat and strncat
  • string copy functions like strcpy and strncpy
  • gets functions like gets and _getts
  • isbad functions like IsBadWritePtr
  • numeric conversion functions like _iota and _itow
  • OEM conversion functions like CharToOem
  • path functions like _splitpath and makepath
  • scan functions like scanf
  • string print functions like sprintf and snprintf
  • string tokenizing functions like strtok

The SV.BANNED family of checkers finds the use of any of the banned functions in code.

The SV.BANNED.REQUIRED.COPY checker flags the use of insecure copy functions.

Vulnerability and risk

Most of these prohibited functions were banned because they can lead to buffer overruns.

As well as functions like strcpy and strcat, the banned list includes many of the corresponding 'n' functions, like strncpy and strncat. Although the 'n' functions are often recommended as replacements for their matching non-'n' functions, they are now considered to have issues with non-null termination of overflowed buffers and lack of error returns on overflows.

Mitigation and prevention

Prohibiting the use of these banned APIs is a good way to remove a significant number of code vulnerabilities. The banned functions should be replaced with more secure versions, or the code should be re-designed to avoid the banned function entirely.

To avoid security issues, it is recommended that you use equivalent safe functions for each category of function when the safe equivalents exist for your compiler. In some cases, there are no replacement functions, so re-architecture of your code is advised.

For Microsoft compiler users, consider using functions from the StrSafe library for the copy functions: StringCchCopy, StringCchCopyN, StringCchCopyEx, StringCchCopyNEx, StringCbCopy, StringCbCopyN, StringCbCopyEx, or StringCbCopyNEx, depending on character count or byte count.

For gcc users, consider using functions from the libssp library, such as __strcpy_chk.c and __strncpy_chk.c.

Another option is the Safe CRT functions, such as strcpy_s or strncpy_s.

As well as using safe replacement functions, it's important to check that the destination buffer is the appropriate size. An option is to consider is using the std::string template class rather than manipulating buffers directly.

If you are using the memcpy, RtlCopyMemory, CopyMemory or wmemcpy functions (which are deprecated in the extended libraries for C, and you are aware of the security risks of not using the extended libraries), you can filter out defects by modifying the body of this KAST checker with the following content:

Copy 
<pattern>
                // CallExpr/Func::IdExpr
                   [ getName() = 'memcpy' ]
                   [ $0 := 'memcpy' ] [ $1 := 'memcpy_s' ]
                   [isMacroDefined('__STDC_LIB_EXT1__')]
                   [isMacroDefined('__STDC_WANT_LIB_EXT1__')]
                </pattern>
                <pattern>
                // CallExpr/Func::IdExpr
                   [ getName() = 'RtlCopyMemory' ]
                   [ $0 := 'RtlCopyMemory' ] [ $1 := 'memcpy_s' ]
                   [isMacroDefined('__STDC_LIB_EXT1__')]
                   [isMacroDefined('__STDC_WANT_LIB_EXT1__')]
                </pattern>
                <pattern>
                // CallExpr/Func::IdExpr
                   [ getName() = 'CopyMemory' ]
                   [ $0 := 'CopyMemory' ] [ $1 := 'memcpy_s' ]
                   [isMacroDefined('__STDC_LIB_EXT1__')]
                   [isMacroDefined('__STDC_WANT_LIB_EXT1__')]
                </pattern>
                <pattern>
                // CallExpr/Func::IdExpr
                   [ getName() = 'wmemcpy' ]
                   [ $0 := 'wmemcpy' ] [ $1 := 'wmemcpy_s' ]
                   [isMacroDefined('__STDC_LIB_EXT1__')]
                   [isMacroDefined('__STDC_WANT_LIB_EXT1__')]
                </pattern>

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.