Potentially unsafe call to strncat¶
ID: cpp/unsafe-strncat
Kind: problem
Security severity: 9.3
Severity: warning
Precision: high
Tags:
- reliability
- correctness
- security
- external/cwe/cwe-788
- external/cwe/cwe-676
- external/cwe/cwe-119
- external/cwe/cwe-251
Query suites:
- cpp-code-scanning.qls
- cpp-security-extended.qls
- cpp-security-and-quality.qls
Click to see the query in the CodeQL repository
The standard library function strncat appends a source string to a target string. The third argument defines the maximum number of characters to append and should be less than or equal to the remaining space in the destination buffer.
Calls of the form strncat(dest, src, strlen(dest)) or strncat(dest, src, sizeof(dest)) set the third argument to the entire size of the destination buffer. Executing a call of this type may cause a buffer overflow unless the buffer is known to be empty.
Similarly, calls of the form strncat(dest, src, sizeof (dest) - strlen (dest)) allow one byte to be written outside the dest buffer.
Buffer overflows can lead to anything from a segmentation fault to a security vulnerability.