Quality: Replace strcpy/strcat with bounded string functions #195

New Issue

2026-07-30T18:35:05+02:00

TapTap commented

2026-07-30 18:35:05 +02:00

Severity: low
Category: quality / security
Location: src/shared/file.c:37, src/shared/utils.c:15,23,32,34,55

Description:
Several code paths use strcpy() and strcat() instead of bounded string functions. Although the current inputs are mostly from local CLI or small fixed strings, this is unsafe and blocks strict static analysis:

file_create() in src/shared/file.c:37 copies path into a buffer allocated from strlen(path)+1. If the length calculation is ever wrong, this is a buffer overflow risk.
str_dup() in src/shared/utils.c:55 uses strcpy() and could be replaced with strdup() or memcpy.
mkdir_r() in src/shared/utils.c:15,23,32,34 uses strcpy() and strcat() on stack buffers.

Suggested fix:

Replace strcpy with memcpy + explicit null termination or snprintf(buf, size, "%s", src).
Use strdup() where available (POSIX.1-2008) or add a bounded str_dup helper.
Audit mkdir_r for path-length overflow and simplify it with snprintf/strncat.

Labels: quality, security

**Severity:** low **Category:** quality / security **Location:** `src/shared/file.c:37`, `src/shared/utils.c:15,23,32,34,55` **Description:** Several code paths use `strcpy()` and `strcat()` instead of bounded string functions. Although the current inputs are mostly from local CLI or small fixed strings, this is unsafe and blocks strict static analysis: - `file_create()` in `src/shared/file.c:37` copies `path` into a buffer allocated from `strlen(path)+1`. If the length calculation is ever wrong, this is a buffer overflow risk. - `str_dup()` in `src/shared/utils.c:55` uses `strcpy()` and could be replaced with `strdup()` or `memcpy`. - `mkdir_r()` in `src/shared/utils.c:15,23,32,34` uses `strcpy()` and `strcat()` on stack buffers. **Suggested fix:** - Replace `strcpy` with `memcpy` + explicit null termination or `snprintf(buf, size, "%s", src)`. - Use `strdup()` where available (POSIX.1-2008) or add a bounded `str_dup` helper. - Audit `mkdir_r` for path-length overflow and simplify it with `snprintf`/`strncat`. **Labels:** quality, security

TapTap added the security quality needs-triage labels 2026-07-30 18:35:05 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:41:58 +02:00

fix: replace strcpy/strcat with bounded memory operations (#195)

TapTap referenced this issue from a commit

2026-07-30 18:45:02 +02:00

fix: replace strcpy/strcat with bounded memory operations (#195)

TapTap referenced this issue from a commit

2026-07-30 18:49:36 +02:00

fix: replace strcpy with bounded memory operations (#195)

TapTap referenced this issue from a commit

2026-07-30 18:49:53 +02:00