Add guidance for C strcpy rule

guidance/DS141863.md

@@ -24,4 +24,4 @@ In the worst case, a buffer overrun vulnerability can provide an attacker the ab
 * [CodeQL: Potentially unsafe call to strcat](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-strcat/)
 * [Microsoft Learn: strcat_s](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strcat-s-wcscat-s-mbscat-s?view=msvc-170)
 * [Avoiding Buffer Overruns](https://learn.microsoft.com/en-us/windows/win32/SecBP/avoiding-buffer-overruns)
-* [OWASP: Buffer Overflow](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow)
+* [OWASP: Buffer Overflow](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow)

guidance/DS185832.md

@@ -1,11 +1,26 @@
-## Banned C function detected (strcpy)
+# Banned C function detected (strcpy)
 
-### Summary
-strcpy is frequently dangerous, as it will cause a buffer overflow if the source is larger than the destination.
+## Summary
 
-### Details
-TO DO - put more details of problem and solution here
+* Use of the `strcpy` function to copy a string can lead to a buffer overrun vulnerability.
+* Use secure versions such as `strcpy_s` to help prevent buffer overruns.
 
-### Severity Considerations
-TO DO - put more details on the severity of the issue here.  Generally how big of a problem is this, and what makes it more or less of a problem?
+## Details
 
+The `strcpy` function does not check for sufficient space in the destination buffer.
+This is a potential cause of a buffer overrun vulnerability.
+A buffer overflow will occur if the source is larger than the destination.
+
+## Solution
+
+Use secure versions such as `strcpy_s` to help prevent buffer overruns.
+
+## Severity Considerations
+
+In the worst case, a buffer overrun vulnerability can provide an attacker the ability to execute arbitrary code leading to complete system compromise.
+
+## References
+
+* [Microsoft Learn: strcpy_s](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strcpy-s-wcscpy-s-mbscpy-s?view=msvc-170)
+* [Avoiding Buffer Overruns](https://learn.microsoft.com/en-us/windows/win32/SecBP/avoiding-buffer-overruns)
+* [OWASP: Buffer Overflow](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow)