Hi all,
I have a compiling error, i couldnt see it compile window but prefast warned me as;
driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is a Banned API as listed in dontuse.h for security purposes.
Found in function ‘InitializeGenericExtension’
what can i do to fix it?
At 12:20 14/02/2011, xxxxx@netas.com.tr wrote:
Hi all,
I have a compiling error, i couldnt see it compile window but
prefast warned me as;
driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is
a Banned API as listed in dontuse.h for security purposes.
Found in function ‘InitializeGenericExtension’what can i do to fix it?
Modify the code so it doesn’t use banned APIs???
Thomas F. Divine
From:
Sent: Monday, February 14, 2011 7:20 AM
To: “Windows System Software Devs Interest List”
Subject: [ntdev] errors - warnings
> Hi all,
> I have a compiling error, i couldnt see it compile window but prefast
> warned me as;
> driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is a
> Banned API as listed in dontuse.h for security purposes.
> Found in function ‘InitializeGenericExtension’
>
> what can i do to fix it?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
Keep in mind that using strcpy_s in your driver will make it fail to load in XP, as strcpy_s and others from dontuse.h appeared a recent kernel, if I recall correctly, starting from 7.
In older WDK, like 6.x when compiling your project you will get something like:
obj : error LNK2019: unresolved external symbol _strcpy_s referenced in function foo@0
If you want you can disable that particular type of warning and check if
things are working for you.
/sarbojit
On Mon, Feb 14, 2011 at 5:50 PM, wrote:
> Hi all,
> I have a compiling error, i couldnt see it compile window but prefast
> warned me as;
> driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is a Banned
> API as listed in dontuse.h for security purposes.
> Found in function ‘InitializeGenericExtension’
>
> what can i do to fix it?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Highly NOT recommended. Include Ntstrsafe.h as a header, link to ntstrsafe.lib, look for RtlStringXxxx functions in the documentation and use them. In application level programming you should be using the corollaries which typically have _s appended such as strcpy_s. About the only time I can justify following sarbojit’s advice is in an inherited project with thousands of references to deprecated functions. However, keeping them active and nagging at you encourages them to be fixed as files are addressed and modified.
Gary G. Little
----- Original Message -----
From: “Sarbojit Sarkar”
To: “Windows System Software Devs Interest List”
Sent: Monday, February 14, 2011 6:55:56 AM
Subject: Re: [ntdev] errors - warnings
If you want you can disable that particular type of warning and check if things are working for you.
/sarbojit
On Mon, Feb 14, 2011 at 5:50 PM, < xxxxx@netas.com.tr > wrote:
Hi all,
I have a compiling error, i couldnt see it compile window but prefast warned me as;
driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is a Banned API as listed in dontuse.h for security purposes.
Found in function ‘InitializeGenericExtension’
what can i do to fix it?
—
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
> Keep in mind that using strcpy_s in your driver will make it fail to load in XP, as strcpy_s
RtlStringXxx are the correct functions.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
There are several consequences of disabling the warning:
(a) your code has been consistently giving the illusion that it is
working, but it is not actually working correctly; you just haven’t yet hit
the situation in which it will fail catastrophically
(b) your code is already seriously broken, but you never noticed because
the brokenness is harmless today. But don’t assume it will remain so.
Although (a) and (b) look the same, they are not; (a) says that you haven’t
yet experienced the situation that will do the damage that results in
catastrophe, and (b) says that it is already causing problems that have not
yet been noticed (the classic is copying a 4-character field into a
4-character buffer, and the NUL character overwrites the next variable,
which this week is always zero so the clobbering of its low-order byte is
harmless, but as soon as it is deployed, the user will do something that
uses a nonzero value and this bug will cause severe damage). Or another way
to say it, (a) says the damage is possible, but hasn’t happened yet and (b)
says the damage is already happening, but isn’t being noticed.
Ideally, you would want to use the STRING type and do all this using the
appropriate Rtl functions, which guarantee there can be no buffer overrun.
But if you use any function which does not check the size of the target
implicitly, you must make sure that you are checking the target size to make
sure there can be no buffer overrun. Sadly, many people assume that the
target is going to be big enough. This usually results in your driver
making the headlines, the kind that say “Virus takes over 300,000 machines
in an hour” and explains how everyone who has your product is vulnerable.
While free publicity is usually good, this kind isn’t.
What you can best do to fix it is not use strcpy in the kernel. Or strcat,
or sprintf. This would be a good start. strcpy was never safe (in fact,
when I started programming in C in 1975, I looked at these functions and
said “these are really stupid ideas” and wrote my own versions of strcpy_s,
strcat_s, and so on, and it only took the C world 30 more years to do the
same!). In some companies, using strcpy is considered a firable offense.
So using it is a habit you should definitely break. By the way, in many of
these situations, it doesn’t matter if you say “but I *do* check the buffer
size before using it!” because the simple presence of an unsafe string
operation is considered violation of program safety standards.
joe
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sarbojit Sarkar
Sent: Monday, February 14, 2011 7:56 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] errors - warnings
If you want you can disable that particular type of warning and check if
things are working for you.
/sarbojit
On Mon, Feb 14, 2011 at 5:50 PM, wrote:
Hi all,
I have a compiling error, i couldnt see it compile window but prefast warned
me as;
driverentry.cpp(255) : warning 28719: Banned API Usage: strcpy is a Banned
API as listed in dontuse.h for security purposes.
Found in function ‘InitializeGenericExtension’
what can i do to fix it?
—
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
–
This message has been scanned for viruses and
dangerous content by http:</http:> MailScanner, and is
believed to be clean.