From ddd22b2f533db9c0da0bb262fbafa51f67c8587e Mon Sep 17 00:00:00 2001 From: jvoisin Date: Fri, 1 May 2026 00:36:32 +0200 Subject: Fix strncat/wcsncat Previously, no checks were done when __n <= __b, but strncat _appends_ after existing content, making this a overly broad check check. For example, with an 8-byte buffer containing "12345\0", strncat(buf, "ABCD", 4) would have the check skipped, but the result "12345ABCD\0" is 10 bytes, resulting in an overflow. This commit fixes this oversight, and adds a bunch of tests. --- tests/test_wcsncat_n_one.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 tests/test_wcsncat_n_one.c (limited to 'tests/test_wcsncat_n_one.c') diff --git a/tests/test_wcsncat_n_one.c b/tests/test_wcsncat_n_one.c new file mode 100644 index 0000000..23de28e --- /dev/null +++ b/tests/test_wcsncat_n_one.c @@ -0,0 +1,18 @@ +#include "common.h" + +#include + +int main(int argc, char** argv) { + wchar_t buffer[8] = {0}; + wcsncat(buffer, L"1234567", 7); + printf("%ls\n", buffer); + + /* n=1, buffer has 7 wchars. + * 7+1+1 = 9 > 8 → overflow. Even n=1 can overflow a nearly-full buffer. */ + CHK_FAIL_START + wcsncat(buffer, L"X", 1); + CHK_FAIL_END + + printf("%ls\n", buffer); + return ret; +} -- cgit v1.3