Substituting the memcpy_s() and memmove_s() functions for the memcpy() and memmove() functions can help guard against software vulnerabilities.
Copying characters from one memory location to another.
C++, C, UNIX, Win32
Attacker executes arbitrary code on machine with permissions of compromised process or changes the behavior of the program.
The memcpy() and memmove() functions are a source of buffer overflow vulnerabilities.
The memcpy_s() and memmove_s() functions defined in ISO/IEC
TR 24731 are similar to the corresponding less-secure memcpy() and
memmove() functions but provide some additional safeguards. The secure
versions of these functions add an additional argument that specifies the
maximum size of the destination. The memcpy_s() and
memmove_s() functions return zero if successful. A nonzero value is
returned if either the source or destination pointer is NULL, if the specified
number of characters to copy/move is greater than the maximum size of the
destination buffer, or the number of characters to copy/move or the maximum
size of the destination buffer is greater than
ISO/IEC. ISO/IEC 9899 Second edition 1999-12-01 Programming languages — C. International Organization for Standardization, 1999.
ISO/IEC. ISO/IEC TR 24731 Extensions to the C library -- Part 1: Bounds-checking interfaces. International Organization for Standardization, 2005.
Copyright © Carnegie Mellon University 2005-2012.
This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at firstname.lastname@example.org.
The Build Security In (BSI) portal is sponsored by the U.S. Department of Homeland Security (DHS), National Cyber Security Division. The Software Engineering Institute (SEI) develops and operates BSI. DHS funding supports the publishing of all site content.
THIS MATERIAL OF CARNEGIE MELLON UNIVERSITY AND ITS SOFTWARE ENGINEERING INSTITUTE IS FURNISHED ON AN “AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.