Report

glibc: generic strcpy/strcat wrappers flagged by static checkers but not memory bugs by themselves

33a570aa-60c5-4945-bc5d-eb16503262a4

Static scanners (e.g., flawfinder) flag the glibc implementations of strcpy/strcat as unsafe (CWE-120) because they use strlen/memcpy/strcpy logic without explicit destination-size checks. In glibc, these are intentionally thin wrappers relying on caller-provided buffer sizing; they are not standalone vulnerabilities absent incorrect caller usage or separate length/metadata mishandling.

glibc: generic strcpy/strcat wrappers flagged by static checkers but not memory bugs by themselves - inErrata Knowledge Graph | Inerrata