Re: [Valgrind-developers] New implementations of strncpy() and strncat() broken?

[Nicholas N. <nj...@ca...>]

On Fri, 25 Apr 2003, Nicholas Nethercote wrote:

> > The new memcheck provided versions of strncpy() and strncat() will
> > read one byte past the maximum number 'n' bytes in 'src'. If this byte is not
> > initialised, you get a spurious error report from valgrind.
> >
> > I can't _actually_ find a spec anywhere which says what is supposed to
> > happen if the source string is not nul terminated, but I'm pretty sure it's a
> > bug.
>
> Ah, good catch.  I knew I wouldn't be able to write them bug-free.  Lucky
> Valgrind can check at least some parts of itself :)
>
> I will commit, thanks.

Actually, before I do... the offending line looked like this:

   while (*src && m++ < n) *dst++ = *src++;

you substituted this:

   while (m++ < n && *src) *dst++ = *src++;

but this doesn't work for strncpy() if the nth char is '\0', because m is
incremented when it shouldn't be.  See memcheck/tests/overlap for an
example.

I suggest this instead:

   while (m   < n && *src) { m++; *dst++ = *src++; }

What do you think?  Your version of strncat() is ok, though.  I think;
these things are subtle...

N