From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: wcsncpy bug Date: Sun, 22 May 2011 21:51:37 -0400 Message-ID: <20110523015137.GT277@brightrain.aerifal.cx> References: <20110523012547.GH6142@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1306116107 19573 80.91.229.12 (23 May 2011 02:01:47 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Mon, 23 May 2011 02:01:47 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-92-gllmg-musl=m.gmane.org@lists.openwall.com Mon May 23 04:01:44 2011 Return-path: Envelope-to: gllmg-musl@lo.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by lo.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1QOKSl-0004Ee-2Q for gllmg-musl@lo.gmane.org; Mon, 23 May 2011 04:01:43 +0200 Original-Received: (qmail 29909 invoked by uid 550); 23 May 2011 02:01:42 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 29897 invoked from network); 23 May 2011 02:01:42 -0000 Content-Disposition: inline In-Reply-To: <20110523012547.GH6142@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:9 Archived-At: On Mon, May 23, 2011 at 03:25:47AM +0200, Szabolcs Nagy wrote: > wcsncpy(d,s,n) did not decrease n while copying the '\0' > so when s[0]=0 and n=1 it wrote 2 zeros to d > diff --git a/src/string/wcsncpy.c b/src/string/wcsncpy.c > index 0164208..fbd0631 100644 > --- a/src/string/wcsncpy.c > +++ b/src/string/wcsncpy.c > @@ -3,7 +3,7 @@ > wchar_t *wcsncpy(wchar_t *d, const wchar_t *s, size_t n) > { > wchar_t *a = d; > - while (n && (*d++ = *s++)) n--; > + while (n-- && (*d++ = *s++)); > wmemset(d, 0, n); Yes it was broken but this patch is too. It will now clobber all memory if the source string does not contain a null terminator, since the final value of n after the while loop will be (size_t)-1. Thanks for catching this bug tho. I'll fix it. Rich