Curl Project Removes strncpy() and strcpy() Functions for Security and Code Safety
By
firesteelrain
A weekday bagel. Dependable, satisfying, no fuss.
Summary
The article discusses the curl project's decision to eliminate both strncpy() and strcpy() functions from their source code due to security concerns and poor API design. The author explains that strncpy() is problematic because it might not null-terminate strings and pads buffers with zeroes, while strcpy() lacks bounds checking. The article advocates for using safer alternatives like snprintf() or custom wrapper functions that ensure proper string handling and error checking.
Key quotes
· 4 pulledstrncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes.
Quite frankly, most code bases are probably better off completely avoiding it because each use of it is a potential mistake.
In that particular rewrite when we made strncpy calls extinct, we made sure we would either copy the full string properly or return error.
It is rare that copying a partial string is the right thing to do.
You might also wanna read
Why Average LLM Use Is Likely Destroying Value in Software Development
The author argues that, contrary to prevailing hype, the average use of Large Language Models (LLMs) is likely destroying value rather than
unessays.substack.com·10h ago
How AI Accelerated Prototyping: From Idea to Tangible in Record Time
The author reflects on how AI has transformed their prototyping workflow. Previously, the biggest bottleneck was the time needed to scaffold
darylcecile.net·10h ago
GitLab 19.0 launches with Secrets Manager, agentic workflows, and self-hosted AI models
GitLab 19.0 has been released, positioning itself as an intelligent orchestration platform for DevSecOps. The release includes expanded secr
bit.ly·23h ago
Centralizing Error Handling in Rust with Custom AppError Enums
This article discusses the importance of centralizing error handling in Rust applications using a custom AppError enum combined with map_err
Zig Devlog: Build System Rework Separates Maker and Configurer Processes
This devlog entry from the Zig programming language project announces a major rework of the build system, separating the maker process from
ziglang.org·1d ago
Study finds most developers refuse to code without AI, raising quality concerns
A February 2026 study by AI research lab METR reveals that most developers now refuse to work without AI coding tools. While these tools hel
techcrunch.com·1d ago