SV.STRBO.BOUND_COPY.OVERFLOW

Buffer Overflow in Bound StringCopy

The SV.STRBO.BOUND_COPY.OVERFLOW checker finds possible buffer overflows in bounded string copy operations strncpy, StrnCpy, safe_strcpy.

Vulnerability and risk

When a buffer overflow happens during string copy operations, it overwrites adjacent memory. This leads to a violation of memory safety.

To avoid such errors, destination buffer size should be properly calculated and the third parameter of bounded string copy functions should be less or equal to buffer size.

Vulnerable code example

1
2
3
4
5
6
 #include <string.h>
 int main(int argc, char* argv[]){
   char foo[10];
   char bar[] = "this text is too long";
   strncpy(foo, bar, sizeof(bar));
 }

Klocwork will report defect SV.STRBO.BOUND_COPY.OVERFLOW in line 5 because destination buffer size 10 is less than source buffer size 22.

Fixed code example 1

1
2
3
4
5
6
#include <string.h>
int main(int argc, char* argv[]){
  char foo[10];
  char bar[] = "this text is too long";
  strncpy(foo, bar, sizeof(foo));
}

In this example, defect SV.STRBO.BOUND_COPY.OVERFLOW will not be reported because during the copy operation, source string will be trimmed to destination buffer size.

Related checkers

• SV.STRBO.BOUND_COPY.UNTERM

External guidance

• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CERT ARR00-C: Understand how arrays work

Security training

Application security training materials provided by Secure Code Warrior.

• Buffer Overflow Training Video - Test your skills with a training example