{"id":3644,"date":"2019-06-22T00:01:15","date_gmt":"2019-06-22T07:01:15","guid":{"rendered":"https:\/\/c-for-dummies.com\/blog\/?p=3644"},"modified":"2019-06-15T14:13:03","modified_gmt":"2019-06-15T21:13:03","slug":"the-perils-of-strncpy","status":"publish","type":"post","link":"https:\/\/c-for-dummies.com\/blog\/?p=3644","title":{"rendered":"The Perils of strncpy()<\/em>"},"content":{"rendered":"

Always be careful when manipulating strings! Tack on that null character, '\\0'<\/code>, at the end of a string! And don’t worry about the C language string functions: They perform this important feature for you. But do they all?
\n
\nWell, not really.<\/p>\n

I discovered an issue when I recently used the strncpy()<\/em> function and found some peculiar output. Not understanding why my output string had extra characters, I perused the man pages and discovered this warning:<\/p>\n

The stpncpy()<\/em> and strncpy()<\/em> functions copy at most len<\/code> characters from src<\/code> into dst<\/code>. If src<\/code> is less than len<\/code> characters long, the remainder of dst<\/code> is filled with `\\0'<\/code> characters. Otherwise, dst<\/code> is not terminated<\/strong>.<\/p><\/blockquote>\n

That last line is significant. When the number of characters copied is shorter than the string being copied, a null character is not added. Therein you find potential for weird strings — and perhaps some unintended buffer overflow.<\/p>\n

Here is sample code that illustrates the problem:<\/p>\n

\r\n#include <stdio.h>\r\n#include <string.h>\r\n\r\nint main()\r\n{\r\n    char source[] = \"My text will be copied\";\r\n    char destination[] = \"123456789012345678901234567890\";\r\n\r\n    strncpy(destination,source,7);\r\n    printf(\"%s\\n\",destination);\r\n\r\n    return(0);\r\n}<\/pre>\n
At Line 9, only 7 characters of string source<\/code> are copied into string destination<\/code>. Because source<\/code> is longer than 7 characters, the null character isn’t appended. Here’s the output:<\/p>\n
My text89012345678901234567890<\/code><\/p>\n
If the destination buffer is uninitialized, the output is unpredictable, spewing forth whatever garbage is in the buffer. This effect is what I saw in my test program.<\/p>\n
The following code shows what happens with the source string is shorter than the length of bytes copied:<\/p>\n
\r\n#include <stdio.h>\r\n#include <string.h>\r\n\r\nint main()\r\n{\r\n    char source[] = \"My text will be copied\";\r\n    char destination[] = \"123456789012345678901234567890\";\r\n\r\n    strncpy(destination,source,25);\r\n    printf(\"%s\\n\",destination);\r\n\r\n    return(0);\r\n}<\/pre>\n
String source<\/code> is only 22 characters long. Hopefully the strncpy()<\/em> function is wise enough to see that it terminates before all 25 characters are copied into the destination<\/code> buffer. Here’s the output:<\/p>\n
My text will be copied<\/code><\/p>\n
The string is copied and terminated as it’s declared; no extra characters are copied. The null character prevents the remainder of the text in the destination<\/code> buffer from appearing.<\/p>\n
I tried to rack my brain to figure out why the null character isn’t added when the source string is longer than the characters copied. A good reason must exist or they wouldn’t have written the function as it is. If you can figure out why such a feature is useful, let me know. I’m sure some valid purpose exists.<\/p>\n","protected":false},"excerpt":{"rendered":"
Most string functions are careful to cap the text they manipulate with a null character. The strncpy()<\/em> function is not so generous. Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-3644","post","type-post","status-publish","format-standard","hentry","category-main"],"_links":{"self":[{"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3644","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3644"}],"version-history":[{"count":3,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3644\/revisions"}],"predecessor-version":[{"id":3658,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/3644\/revisions\/3658"}],"wp:attachment":[{"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/c-for-dummies.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}