Fixed

Fixed bug in strncpy() and strncat() -- they were giving the right answers, but
could read the (n+1)th char, which could possibly be inaccessible.  Thanks to
Adam Gundy <arg@cyberscience.com> for spotting it.

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@1557

diff --git a/memcheck/mc_replace_strmem.c b/memcheck/mc_replace_strmem.c
index 7c84dbc081e9efacf108a7ab178f25040ae9eb58..28a12c517bb33a072a60b3f4d2d2fe93d09936ab 100644 (file)
--- a/memcheck/mc_replace_strmem.c
+++ b/memcheck/mc_replace_strmem.c
@@ -123,8 +123,8 @@ char* strncat ( char* dst, const char* src, int n )
    Int   m = 0;
 
    while (*dst) dst++;
-   while (*src && m++ < n) *dst++ = *src++;  /* concat at most n chars */
-   *dst = 0;                                 /* then add null (always) */
+   while (m   < n && *src) { m++; *dst++ = *src++; } /* concat <= n chars */
+   *dst = 0;                                         /* always add null ) */
 
    /* This checks for overlap after copying, unavoidable without
       pre-counting lengths... should be ok */
@@ -164,7 +164,7 @@ char* strncpy ( char* dst, const char* src, int n )
    if (is_overlap(dst, src, n))
       complain3("strncpy", dst, src, n);
 
-   while (*src && m++ < n) *dst++ = *src++;
+   while (m   < n && *src) { m++; *dst++ = *src++; }
    while (m++ < n) *dst++ = 0;         /* must pad remainder with nulls */
 
    return dst_orig;