Re: strncpy clarify result may not be null terminated

Paul Eggert
2023-11-10T17:49:23Z

On 2023-11-09 15:48, Alejandro Colomar wrote:
> I'd then just use strlen(3)+strcpy(3), avoiding
> strncpy(3).

But that is vulnerable to the same denial-of-service attack that strlcpy
is vulnerable to. You'd need strnlen+strcpy instead.

The strncpy approach I suggested is simpler, and (though this doesn't
matter much in practice) is typically significantly faster than
strnlen+strcpy in the typical case where the destination is a small
fixed-size buffer.

Although strncpy is not a good design, it's often simpler or faster or
safer than later "improvements".