fortify-headers/include/wchar.h, branch master

Fix strncat/wcsncat

2026-04-30T22:44:53Z

Previously, no checks were done when __n <= __b, but strncat _appends_ after existing content, making this a overly broad check check. For example, with an 8-byte buffer containing "12345\0", strncat(buf, "ABCD", 4) would have the check skipped, but the result "12345ABCD\0" is 10 bytes, resulting in an overflow. This commit fixes this oversight, and adds a bunch of tests.

Fix mbsnrtowcs

2026-04-30T16:06:56Z

mbsnrtowcs writes up to __wn wide characters into wchar_t *__d. The destination capacity is __b / sizeof(wchar_t) wide characters, but the else branch clamps __n (source byte limit) to __b (destination byte size). __wn (the actual output count) is passed through unclamped. Example: __b=8 (dest holds 2 wchar_t), __n=100, __wn=25. The else branch applies (25 <= 100/4), clamps source to 8 bytes, but passes __wn=25 — the function can write 25 wchar_t (100 bytes) into an 8-byte buffer. The first branch is also wrong: it divides __b (bytes) by sizeof(wchar_t) to get wchar_t capacity, which is correct for the destination — but the condition __wn > __n / sizeof(wchar_t) uses integer division that can produce incorrect routing between branches. The fix mirrors the already-correct mbsrtowcs pattern: clamp __wn (the output wide-char count) to the destination's wchar_t capacity, and pass __n (source byte limit) through unchanged.

Improve coverage for wmemcpy and wmemmove

2026-04-30T15:50:27Z

Like it's already done for memcpy and memmove. Add tests as well, to prove that nothing broke.

Fix a bug in wcsnrtombs

2026-04-30T15:42:29Z

__d is a char * destination buffer, so __b is already the byte capacity. Dividing by sizeof(wchar_t) makes no sense here, it was likely copy-pasted from mbsnrtowcs (where the destination is wchar_t *). The first branch also fails to limit __n (the byte write cap) to __b, so overflows are possible when a wide character produces multi-byte output. The second branch (else) correctly limits __n to __b. This commit replaces the broken two-branch logic with the simple correct pattern matching wcsrtombs, and adds two tests two prove that nothing broke.

Remove wctomb

2025-11-10T22:55:25Z

It's unfortunately valid to pass a buffer smaller than MB_CUR_MAX to wctomb, so let's not trap on this. Moreover, it's supposed to be implemented in stdlib.h and not wchar.h anyway.

add initial clang support

2025-10-31T21:16:21Z

Co-Authored-By: jvoisin

avoid extension with clang

2025-10-31T21:16:21Z

It seems useless and triggers 'error: expected external declaration'

Make use of __builtin_dynamic_object_size

2025-10-31T21:16:21Z

GCC and Clang provide __builtin_dynamic_object_size (see documentation: https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html), so we should make use of it when its available.

wctomb, wcrtomb: guard slow/trap path with MB_LEN_MAX

2019-03-07T00:05:34Z

This allows the compiler to optimize out the slow/trap path at all for the typical correct code: char buf[MB_LEN_MAX]; r = wctomb(buf, c); The change tries to keep the "unknown object size" case handling in wcrtomb() as is even if it seems redundant and not helping (we copy __buf to possibly undersized __s in any case) and inconsistent with wctomb() (where we let the original library method itself overwrite the possibly undersized __s).

Make use of builtins whenever possible

2019-02-25T13:17:08Z

fortify-headers/include/wchar.h, branch master

Fix strncat/wcsncat

Fix mbsnrtowcs

Improve coverage for wmemcpy and wmemmove

Fix a bug in wcsnrtombs

Remove wctomb

add initial clang support

avoid __extension__ with clang

Make use of __builtin_dynamic_object_size

wctomb, wcrtomb: guard slow/trap path with MB_LEN_MAX

Make use of builtins whenever possible

avoid extension with clang