5 files changed, 55 insertions, 1 deletions

diff --git a/include/string.h b/include/string.h
index f738901..9bf17a0 100644
--- a/include/string.h
+++ b/include/string.h
@@ -104,8 +104,13 @@ __access(write_only, 1)
 __access(read_only, 2, 3)
 _FORTIFY_FN(stpncpy) char *stpncpy(char *__d, const char *__s, size_t __n)
 {
-        size_t __b = __bos(__d, 0);
+        /* trap if pointers are overlapping but not if dst == src.
+         * gcc seems to like to generate code that relies on dst == src */
+        if ((__d < __s && __d + __n > __s) ||
+            (__s < __d && __s + __n > __d))
+                __builtin_trap();
 
+        size_t __b = __bos(__d, 0);
         if (__n > __b && strlen(__s) + 1 > __b)
                 __builtin_trap();
         return __orig_stpncpy(__d, __s, __n);
diff --git a/tests/Makefile b/tests/Makefile
index 6722add..11718cc 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -22,6 +22,9 @@ TARGETS=test_memcpy_static_write     \
         test_strncpy_overwrite_over  \
         test_strncpy_overwrite_under \
         test_strncpy_static_write    \
+        test_stpncpy_overwrite_over  \
+        test_stpncpy_overwrite_under \
+        test_stpncpy_static_write    \
         test_getcwd                  \
 
 .SILENT:
diff --git a/tests/test_stpncpy_overwrite_over.c b/tests/test_stpncpy_overwrite_over.c
new file mode 100644
index 0000000..e66d8d3
--- /dev/null
+++ b/tests/test_stpncpy_overwrite_over.c
@@ -0,0 +1,15 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'};
+  puts(buffer);
+
+  CHK_FAIL_START
+  stpncpy(buffer+1, buffer, 5);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_stpncpy_overwrite_under.c b/tests/test_stpncpy_overwrite_under.c
new file mode 100644
index 0000000..5625ff8
--- /dev/null
+++ b/tests/test_stpncpy_overwrite_under.c
@@ -0,0 +1,15 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'};
+  puts(buffer);
+
+  CHK_FAIL_START
+  stpncpy(buffer-1, buffer, 5);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_stpncpy_static_write.c b/tests/test_stpncpy_static_write.c
new file mode 100644
index 0000000..4bf9092
--- /dev/null
+++ b/tests/test_stpncpy_static_write.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  stpncpy(buffer, "1234567", 5);
+  puts(buffer);
+
+  CHK_FAIL_START
+  stpncpy(buffer, "1234567890", 10);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}