You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
strcpy will attempt to read past the bounds of src in order to look for a null terminator (\0 character). Just doing that is UB.
If strcpy is lucky enough to find a null terminator, it will write bothsrcand the null terminator (thus, two characters) to &dst. This is UB because dst only points to one character. It could clobber something on the stack (maybe even src).
There's no guarantee that the next character after src is a null terminator. This means strcpy could clobber arbitrarily many bytes on the stack with random other bytes on the stack.
The text was updated successfully, but these errors were encountered:
mhoemmen
added a commit
to mhoemmen/raft
that referenced
this issue
Sep 27, 2022
Given `char src` and `char dst`, one should copy them like `dst = src`, not like `strcpy(&dst, &src)`.
Using `strcpy` in this way invokes undefined behavior, and may cause stack corruption.
Fixes#847.
Authors:
- Mark Hoemmen (https://github.com/mhoemmen)
Approvers:
- Corey J. Nolet (https://github.com/cjnolet)
URL: #848
There are a few parts of the SVD function that do
strcpy(&dst, &src)
, where each ofdst
andsrc
is achar
. For example:raft/cpp/include/raft/linalg/detail/svd.cuh
Line 71 in 1dd2feb
This is incorrect for several reasons.
strcpy
will attempt to read past the bounds ofsrc
in order to look for a null terminator (\0
character). Just doing that is UB.strcpy
is lucky enough to find a null terminator, it will write bothsrc
and the null terminator (thus, two characters) to&dst
. This is UB becausedst
only points to one character. It could clobber something on the stack (maybe evensrc
).src
is a null terminator. This meansstrcpy
could clobber arbitrarily many bytes on the stack with random other bytes on the stack.The text was updated successfully, but these errors were encountered: