Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

10
  • 11
    I do not completely agree. It would be nice if strlcpy and strlcat would report some sort of error condition if they bumped against the destination buffer size limit. Though you can check the returned length to test this, it's not obvious. But I think that's a minor criticism. The 'they encourage the use of C strings, and so they are bad' argument is silly. Commented Oct 4, 2012 at 18:12
  • 7
    "how these functions can lead to security problems" - fwiw I think the issue here is that some C functions are harder to use correctly than others. Some people have a mistaken belief that there is a special threshold of difficulty, below which a function is "secure" and above which it is "insecure". Such people are also usually of the belief that strcpy is above the threshold and hence "insecure", and their preferred string-copying function (whether it is strlcpy, strcpy_s or even strncpy) is below the threshold and hence "secure". Commented Nov 19, 2012 at 11:37
  • 34
    There are plenty of reasons for disliking strlcpy/strlcat, but you don't state any of them. The discussion of C++ and Java is irrelevant. This answer just isn't helpful to the subject matter the question actually asked about. Commented Mar 11, 2013 at 20:19
  • 26
    @John Ripley: Firstly, I'm not "stating any of them" simply because I'm not aware of any reasons for disliking strlcpy/strlcat. One might "dislike" the general concept of zero-terminated string, but that's not what the question is about. If you know "plenty of reasons to dislike strlcpy/strlcat", you should probably write your own answer instead of expecting me to be able to read someone else's mind. Commented Mar 12, 2013 at 0:05
  • 10
    @John Ripley: Secondly, the question was specifically referring to some alleged "security problems" with strlcpy/strlcat. While I believe I understand what this is about, I personally refuse to recognize that as "security problems" within the realm of traditional C language, as I know it. That I stated in my answer. Commented Mar 12, 2013 at 0:07