Security Issues with STL?
D K <[email protected]> Thu, 2 Sep 2004 14:29:13 -0400
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <[email protected]> |
Hi, I have found scattered information about security issues related to STL on the internet and am not sure if Standards Template Library should be used or not used from security point of view. If it should be used what are the issues one should be aware of ? So far I have found 3 different references to STL (a couple of them from Writing secure code 2) and one form MS website. 1) Standard Template Library stream operator (>>) copies data from an input source to a variable. If the input is untrusted, this could potentially lead to a buffer overrun. (WSC2) 2) Using the STL can throw exceptions under low-memory conditions or if you encounter errors (WSC2). 3) Buffer overrun using iterators (MS website - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure03102004.asp). Are there any more known issues with STL ? Thanks DK.