Share via

Security Issues for String Functions (Windows Embedded CE 6.0)

  • Article

1/5/2010

String functions give applications the means to copy, compare, sort, format, and convert character strings as well as the means to determine the character type of each character in a string.

All string functions support the single-byte, double-byte, and Unicode character sets if these character sets are supported by the OS that the application is run on.

The incorrect use of string functions can cause security problems for your application. Typically, this involves

  • A buffer overrun, which can allow a denial of service attack against your application
  • The injection of executable code from an attacker

The following Strsafe functions enable the safer handling of strings and are recommended for better security for your application. For more information on these functions, see Using Strsafe.h.

Standard CRT function StrSafe Function

strcat

StringCchCat, StringCchCatEx, StringCbCat, StringCbCatEx

strcmp

(no equivalent function)

strcpy

StringCchCopy, StringCchCopyEx, StringCbCopy, StringCbCopyEx

strlen

StringCchLength, StringCbLength

The following table shows the Unicode extensions to the standard C run-time (CRT) functions sprintf and vsprintf.

Standard CRT function String Function StrSafe Function

sprintf

wsprint

StringCchPrintf, StringCchPrintfEx, StringCbPrintf, StringCbPrintfEx

vsprintf

wvsprintf

StringCchVPrintf, StringCchVPrintfEx, StringCbVPrintf, StringCbVPrintfEx

See Also

Reference

Safe String Reference

Concepts

Using Strsafe.h

Other Resources

Safe String Functions