From ddd22b2f533db9c0da0bb262fbafa51f67c8587e Mon Sep 17 00:00:00 2001 From: jvoisin Date: Fri, 1 May 2026 00:36:32 +0200 Subject: Fix strncat/wcsncat Previously, no checks were done when __n <= __b, but strncat _appends_ after existing content, making this a overly broad check check. For example, with an 8-byte buffer containing "12345\0", strncat(buf, "ABCD", 4) would have the check skipped, but the result "12345ABCD\0" is 10 bytes, resulting in an overflow. This commit fixes this oversight, and adds a bunch of tests. --- tests/test_wcsncat_n_gt_buf.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 tests/test_wcsncat_n_gt_buf.c (limited to 'tests/test_wcsncat_n_gt_buf.c') diff --git a/tests/test_wcsncat_n_gt_buf.c b/tests/test_wcsncat_n_gt_buf.c new file mode 100644 index 0000000..186b8c0 --- /dev/null +++ b/tests/test_wcsncat_n_gt_buf.c @@ -0,0 +1,17 @@ +#include "common.h" + +#include + +int main(int argc, char** argv) { + wchar_t buffer[8] = {0}; + wcsncat(buffer, L"12345", 5); + printf("%ls\n", buffer); + + /* n > buffer capacity and overflow: n=10, buffer has 5 wchars. */ + CHK_FAIL_START + wcsncat(buffer, L"1234567890", 10); + CHK_FAIL_END + + printf("%ls\n", buffer); + return ret; +} -- cgit v1.3