V1.21 (strncat is broken)

Thread View: comp.bugs.2bsd

4 messages

[T] Back to Threads [V] Tree View [G] Group Articles

4 total messages Started by Keith Bostic Wed, 06 Jan 1988 20:02

#175

Author: Keith Bostic
Date: Wed, 06 Jan 1988 20:02

35 lines
1114 bytes

Subject: strncat is broken
Index: lib/libc/pdp/gen/strncat.s 2.10BSD

Description:
	strncat(3) doesn't truncate strings correctly.

Repeat-By:
	The following program demonstrates the bug.

	#include <stdio.h>
	#include <strings.h>
	main()
	{
		char *s = "This is a long string, but we'll truncate it at the comma";
		s[21] = '\0';
		printf("%s\n", s);
		strncat(s, "Arragh!!", 7);
		printf("%s\n", s);
	}

Fix:
	Apply the following patch.

*** strncat.s.orig	Wed Jan  6 11:41:24 1988
--- strncat.s	Wed Jan  6 11:41:34 1988
***************
*** 36,41 ****
--- 36,42 ----
  	movb	(r2)+,(r1)+	/ copy s2 to the end of s1 stopping at the
  	beq	3f		/   end of s2 or when n runs out ...
  	sob	r0,2b
+ 	clrb	(r1)
  3:
  	mov	(sp)+,r2	/ restore r2
  4:

Re: V1.21 (strncat is broken)

#179

Author: John P. Nelson
Date: Thu, 07 Jan 1988 17:42

9 lines
760 bytes

>Description:
>	strncat(3) doesn't truncate strings correctly.

Please don't "fix" this "bug".  It is DOCUMENTED to work this way.  If
the second string is longer than the size "n" supplied, then NO NULL
TERMINATER is appended.  It is your MISUSE of "strncat" at fault here!

I agree, it is a pain in the ass, but this is the way strncat has
always worked since the beginning of C!

Re: V1.21 (strncat is broken)

#182

Author: Casey Leedom
Date: Fri, 08 Jan 1988 04:20

25 lines
1694 bytes

In article <4557@teddy.UUCP> jpn@teddy.UUCP (John P. Nelson) writes:
>>Description:
>>	strncat(3) doesn't truncate strings correctly.
>
>Please don't "fix" this "bug".  It is DOCUMENTED to work this way.  If
>the second string is longer than the size "n" supplied, then NO NULL
>TERMINATER is appended.  It is your MISUSE of "strncat" at fault here!

  No, it is a bug.  I'm embarrassed as the writer of the routine to admit it.
The manual page says the following:

     Strcat appends a copy of string s2 to the end of string s1.
     Strncat copies at most n characters.  Both return a pointer
     to the null-terminated result.

Since the original string is already NUL terminated, appending n
characters from s2 to the end of s1 and then NUL terminating the result
can really be thought of as inserting n characters just before the NUL in
s1.  You'll also note that both the C and VAX assembler versions NUL
terminate the result when strlen(s2) > n.  (Though the C version does have
an error in it because it won't handle n==0 and really should stop
copying one character earlier (it copies a character and then has to
stomp on it with a NUL.))

Casey

Re: V1.21 (strncat is broken)

#180

Author: Rob Warnock
Date: Fri, 08 Jan 1988 05:41

27 lines
1457 bytes

In article <4557@teddy.UUCP> you write:
+---------------
| >	strncat(3) doesn't truncate strings correctly.
| Please don't "fix" this "bug".  It is DOCUMENTED to work this way.  If
| the second string is longer than the size "n" supplied, then NO NULL
| TERMINATER is appended.  It is your MISUSE of "strncat" at fault here!
| I agree, it is a pain in the ass, but this is the way strncat has
| always worked since the beginning of C!
+---------------

Sorry, "jpn", Keith was right the first time. The posted fix was to "strncat",
NOT to "strncpy"! (Yeah, I had to look twice, myself...)

True, "strncpy(dest, src, n)" does (read "MUST") leave the string unterminated
if strlen(src) >= n, but "strncat(dest, src, n)" ALWAYS null-terminates (after
copying at most "n" bytes).

Better luck next time...   ;-}


Rob Warnock
Systems Architecture Consultant

UUCP:	  {amdcad,fortune,sun,attmail}!redwood!rpw3
ATTmail:  !rpw3
DDD:	  (415)572-2607
USPS:	  627 26th Ave, San Mateo, CA  94403

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads