Microsoft Bans memcpy()

For those writing in C, you will be interested in a posting on The Security Development Lifecycle (SDL) blog titled Please Join me in welcoming memcpy() to the SDL Rogues Gallery. Memcpy’s drawback comes when the source to be copied contains more bytes than its destination, creating overflows that present attackers with opportunities to remotely execute code in the underlying application.

memcpy() will soon join strcpy(), strcat(), strncpy(), strncat(), gets() and others banned in coding at Microsoft. “We can only ban functionality that has been demonstrated to cause security vulnerabilities and only if there is a viable alternative,” the blog says.

The posting adds, “We intend to add memcpy() will to the SDL C and C++ banned API list later this year as we make further revisions to the SDL. Right now, memcpy() is on the SDL Recommended banned list, but will soon be added to the SDL banned API requirement list now that we have more feedback from Microsoft product groups.”

On MSDN, you can find the SDL list of Banned Function Calls. A header file is provided, banned.h. By including this header file , then using #include “banned.h”; you will be able to locate any banned functions in your code. The full list of banned APIs is also included in the header file.

The alternative is also suggested on the blog. Developers who want to be SDL compliant will replace memcpy() functions with memcpy_s, a newer command that takes an additional parameter expressing the size of the destination buffer.

For more information, see  Please Join me in welcoming memcpy() to the SDL Rogues Gallery and Good hygiene and Banned APIs. For more information about SDL, see The Microsoft Security Development Lifecycle (SDL) on MSDN.