From ddd22b2f533db9c0da0bb262fbafa51f67c8587e Mon Sep 17 00:00:00 2001 From: jvoisin Date: Fri, 1 May 2026 00:36:32 +0200 Subject: Fix strncat/wcsncat Previously, no checks were done when __n <= __b, but strncat _appends_ after existing content, making this a overly broad check check. For example, with an 8-byte buffer containing "12345\0", strncat(buf, "ABCD", 4) would have the check skipped, but the result "12345ABCD\0" is 10 bytes, resulting in an overflow. This commit fixes this oversight, and adds a bunch of tests. --- tests/test_strncat_n_eq_buf.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 tests/test_strncat_n_eq_buf.c (limited to 'tests/test_strncat_n_eq_buf.c') diff --git a/tests/test_strncat_n_eq_buf.c b/tests/test_strncat_n_eq_buf.c new file mode 100644 index 0000000..bbc39d2 --- /dev/null +++ b/tests/test_strncat_n_eq_buf.c @@ -0,0 +1,18 @@ +#include "common.h" + +#include + +int main(int argc, char** argv) { + char buffer[8] = {0}; + strncat(buffer, "12345", 5); + puts(buffer); + + /* n == buffer size but overflow due to existing content. + * buffer has 5 chars, src "ABC" (len 3): 5+3+1 = 9 > 8 → overflow. */ + CHK_FAIL_START + strncat(buffer, "ABC", 8); + CHK_FAIL_END + + puts(buffer); + return ret; +} -- cgit v1.3