The string copy function is used to copy a string of characters to a buffer of memory. The strcpy function has no argument to limit the size of the written data, so a buffer overflow may result.

The SV.UNBOUNDED_STRING_INPUT.FUNC checker looks for code calling insecure string copy functions that don't specify a buffer size, like gets(), gettext(), or catgets().

Vulnerability and risk

If the string copy function is called without a size parameter, a buffer overrun error can result. This can lead to application instability or, with a carefully constructed attack, code injection, or other vulnerabilities.

Mitigation and prevention

To avoid this vulnerability

make sure you use functions that have buffer size as an input parameter, like fgets instead of gets
for Windows, use StrSafe functions String*Gets, such as StringCchGets, or Safe CRT functions like gets_s
use a function like strlen() to determine the buffer size you need

Vulnerable code example 1

1   #include <stdio.h>
2   
3   int main()
4   {
5     char string [256];
6     printf ("Insert your full address: ");
7     gets (string);                /* SV.UNBOUND_STRING_INPUT.FUNC reported here */
8     printf ("Your address is: %s\n",string); 
9     return 0;
10  }

Fixed code example 1

1   #include <stdio.h>
2   
3   int main()
4   {
5     char string [256];
6     printf ("Insert your full address: ");
7     fgets (string, 256, stdin);    /* No checker reported because fgets considers the size of the string array */
8     printf ("Your address is: %s\n",string);
9     return 0;
10  }

Vulnerable code example 2

1   #include <stdio.h>
2   
3   int main()
4   {
5     char string [256];
6     printf ("Please Enter Your Full Name:");
7     _gettws (string);             /* SV.UNBOUND_STRING_INPUT.FUNC reported here */
8     printf ("Your Full Name Is: %s\n", string);
9     return 0;
10  }

Fixed code example 2

1   #include <stdio.h>
2   
3   int main()
4   {
5     char string [256];
6     printf ("Please Enter Your Full Name:");
7     gets_s (string, strlen(string));  /* no SV.UNBOUND_STRING_INPUT.FUNC reported here */
8     printf ("Your Full Name Is: %s\n", string);
9     return 0;
10  }

Related checkers

SV.UNBOUND_STRING_INPUT.CIN

SV.UNBOUND_STRING_INPUT.FUNC

Buffer overflow from unbounded string copy