Hi Serge,

On 2026-07-26T21:39:34-0500, Serge E. Hallyn wrote:
> > [...]
> > > > @@ -5,10 +5,7 @@
> > > >  .\"
> > > >  .TH strncat 3 (date) "Linux man-pages (unreleased)"
> > > >  .SH NAME
> > > > -strncat
> > > > -\-
> > > > -append non-null bytes from a source array to a string,
> > > > -and null-terminate the result
> > > > +strncat \- nonstring catenate
> > > 
> > > why nonstring?  The source string doesn't *have* to be a string,
> > > but can be, right?
> > 
> > Yup, it can be a string, although it would be useless (if you want
> > a string, you can use strcat(3)).
> 
> If the destination is 10 bytes long and has a 5 character string now,
> and the source is a valid string that's 15 characters long, it's still
> not safe to use strcat.

It's not safe to use strncat(3) either.  At least for my high standards.
It's full of off-by-one opportunities, and other opportunities for bugs,
which will result in buffer overflows.  :)

One should write and use strtcat().  Here's a patch set for doing that
in shadow, FWIW: <https://github.com/shadow-maint/shadow/pull/1334>.
That patch set is very small, so if you merge it already,
I'd appreciate it.


Have a lovely day!
Alex

-- 
<https://www.alejandro-colomar.es>