first of all let me say that I started to study the C three days ago. As exercise I'm reading source code as much as I can. I thought I'd start with Tor and, in this file src/common/compat_libevent.c, I found something that has puzzled me (n = strlcpy(buf, msg, sizeof(buf));):

libevent_logging_callback(int severity, const char *msg)
  char buf[1024]; //size of buf
  size_t n; //store the maximum size of n
  if (suppress_msg && strstr(msg, suppress_msg)) //if suppress_msg is not NULL and in suppress_msg there is msg...
  n = strlcpy(buf, msg, sizeof(buf)); //here I'm confused: msg, for example, of 2048 bytes will lead to a buffer overflow... or not?
  if (n && n < sizeof(buf) && buf[n-1] == '\n') {
    buf[n-1] = '\0';

A msg, for example, of 2048 bytes will lead to a buffer overflow, right (or not)?

  • There should be no problem, but your concern about coding standarts is a very good point: as for me, I'd use a global define clause like BUFFER_LENGTH and used it as a size specifier, so there would be no such concerns at all. – Alexey Vesnin Oct 20 '16 at 17:51
  • Okay but now you have two functions which have buffers of different length, and you just specified BUFFER_LENGTH as a global variable. That's poor form. Secondly, sizeof is a placeholder that is expanded to a constant size at compile time and will always be the size of buf. There aren't any concerns, this is already better coding practice than your suggestion. – cacahuatl Oct 21 '16 at 10:34

The manpage for strlcpy() says:

The strlcpy() function copies up to size - 1 characters from the NUL-terminated string src to dst, NUL-terminating the result.

So the size in your example is 1024 Bytes (sizeof(buf)). As far as I understand it it will copy 1023 from msg and terminate with NUL. Even if you enter a data block which is larger. So there is no buffer overflow possible. People in https://stackoverflow.com could possibly explain this in more detail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.