jvoisin/fortify-headers

strncpy/stpncpy overlap checks are defective

Closed this issue · 1 comments

q66 commented

They check overlap across the whole range of the given length, but the given length is not what will actually be copied, rather it's the maximum length (if src is shorter, only length of src will be copied). This triggers false positives and traps where it shouldn't (e.g. in ICU tests).

Fixed by #50