Re: generic strncpy - off-by-one error

[Willy Tarreau <willy@w.ods.org>]

On Tue, Aug 12, 2003 at 11:07:59PM +0900, Yoshinori Sato wrote:
> zero fill count is off-by-one error

I disagree here. With your code, if count becomes 0 within the first while(),
you set it to (unsigned)(-1) (because count is size_t), and the second loop
will add this number of zeroes after dest (4 billion on 32 bits archs).

The original code seems OK to me.

Cheers,
Willy

> --- lib/string.c~	2003-08-09 20:30:36.000000000 +0900
> +++ lib/string.c	2003-08-12 22:55:47.000000000 +0900
> @@ -89,7 +89,8 @@
>  
>  	while (count && (*dest++ = *src++) != '\0')
>  		count--;
> -	while (count) {
> +	count--;
> +	while (count > 0) {
>  		*dest++ = 0;
>  		count--;
>  	}