Hi,
I am getting security threat in UDPEcho.m class file
There are 1 occurrence of strncpy function which is an insecure function acc to security tool.
static WCINLINE unsigned int mypskclientcallback(WOLFSSL* ssl, const char* hint,
char* identity, unsigned int idmaxlen, unsigned char* key,
unsigned int keymaxlen)
{
(void)ssl;
(void)hint;
(void)keymaxlen;
/* identity is OpenSSL testing default for openssl sclient, keep same */
strncpy(identity, wolfsslPSKIdentityHint, idmaxlen);
for(int i = 0; i < wolfsslMasterToken.length; i++)
{
key[i] = [wolfsslMasterToken characterAtIndex:i];
}
return 16; /* length of key in octets or 0 for error */
}
Below is the issue description and reference links from security team.
Issue description : Use of insecure functions/potential dangerous functions
Reference link: CWE-676: Use of Potentially Dangerous Function
This would explain why SECURITY TEAM is recommending the change of these functions.
Please provide solution for this as soon as possible as it is very urgent.
Thanks and Regards,
Priya Mehndiratta
I am getting security threat in UDPEcho.m class file
There are 1 occurrence of strncpy function which is an insecure function acc to security tool.
static WCINLINE unsigned int mypskclientcallback(WOLFSSL* ssl, const char* hint,
char* identity, unsigned int idmaxlen, unsigned char* key,
unsigned int keymaxlen)
{
(void)ssl;
(void)hint;
(void)keymaxlen;
/* identity is OpenSSL testing default for openssl sclient, keep same */
strncpy(identity, wolfsslPSKIdentityHint, idmaxlen);
for(int i = 0; i < wolfsslMasterToken.length; i++)
{
key[i] = [wolfsslMasterToken characterAtIndex:i];
}
return 16; /* length of key in octets or 0 for error */
}
Below is the issue description and reference links from security team.
Issue description : Use of insecure functions/potential dangerous functions
Reference link: CWE-676: Use of Potentially Dangerous Function
This would explain why SECURITY TEAM is recommending the change of these functions.
Please provide solution for this as soon as possible as it is very urgent.
Thanks and Regards,
Priya Mehndiratta