Re: generic strncpy - off-by-one error

Willy Tarreau
2003-08-12T14:39:12Z

On Tue, Aug 12, 2003 at 11:07:59PM +0900, Yoshinori Sato wrote:
> zero fill count is off-by-one error

I disagree here. With your code, if count becomes 0 within the first while(),
you set it to (unsigned)(-1) (because count is size_t), and the second loop
will add this number of zeroes after dest (4 billion on 32 bits archs).

The original code seems OK to me.

Cheers,
Willy

> --- lib/string.c~ 2003-08-09 20:30:36.000000000 +0900
> +++ lib/string.c 2003-08-12 22:55:47.000000000 +0900
> @@ -89,7 +89,8 @@
>
> while (count && (*dest++ = *src++) != '\0')
> count--;
> - while (count) {
> + count--;
> + while (count > 0) {
> *dest++ = 0;
> count--;
> }