Description

A customer reported that their security vulnerability tool reported our repository has the following security issue: CWE-676, which stands for the use of potentially dangerous functions.

For all tasks, we should check if we should do this quickly. If replacing is a bit complicated, needs refactoring to make things testable, we should reconsider the priority.

Clarified fixes for dangerous functions:

• Replace strncpy with strlcpy #2783
• Validate safe usage of return values of vsnprintf #2784
• ref: convert an sprintf call to snprintf #2866
• ref: convert last sprintf call to snprintf #3077

The following usage functions need clarification:

• memcpy - what are the downsides? Should we replace their usage?
• sscanf - Maybe replace it with safer scanf_s?
• strlen - you do not know the size of the original source buffer when using it. Is there a safer API?
• calloc - Should we replace our usages with malloc?