Security Issues for String Functions
Other versions of this page are also available for the following:
.gif "A hyphen indicates that the information in this topic is not relevant for this platform, or that the platform does not support the API that is listed.")
.gif "A checkmark indicates that the information in this topic is relevant for this platform, and that any API listed is also supported on this platform.")
8/27/2008
String functions give applications the means to copy, compare, sort, format, and convert character strings as well as the means to determine the character type of each character in a string.
All string functions support the single-byte, double-byte, and Unicode character sets if these character sets are supported by the OS that the application is run on.
The incorrect use of string functions can cause security problems for your application. Typically, this involves
- A buffer overrun, which can allow a denial of service attack against your application
- The injection of executable code from an attacker
The following Strsafe functions enable the safer handling of strings and are recommended for better security for your application. For more information on these functions, see Using Strsafe.h.
| Standard CRT function | StrSafe Function |
|---|---|
strcat |
|
strcmp |
(no equivalent function) |
strcpy |
StringCchCopy, StringCchCopyEx, StringCbCopy, StringCbCopyEx |
strlen |
The following table shows the Unicode extensions to the standard C run-time (CRT) functions sprintf and vsprintf.
| Standard CRT function | String Function | StrSafe Function |
|---|---|---|
sprintf |
StringCchPrintf, StringCchPrintfEx, StringCbPrintf, StringCbPrintfEx |
|
vsprintf |
StringCchVPrintf, StringCchVPrintfEx, StringCbVPrintf, StringCbVPrintfEx |