From: Nicholas Nethercote <njn@valgrind.org>
Date: Fri, 25 Apr 2003 21:37:20 +0000 (+0000)
Subject: Fixed
X-Git-Tag: svn/VALGRIND_2_0_0~202
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c9acb6f0d2ddf827df55fda1d6263fe27ea6c56b;p=thirdparty%2Fvalgrind.git

Fixed
Fixed bug in strncpy() and strncat() -- they were giving the right answers, but
could read the (n+1)th char, which could possibly be inaccessible.  Thanks to
Adam Gundy <arg@cyberscience.com> for spotting it.


git-svn-id: svn://svn.valgrind.org/valgrind/trunk@1557
---

diff --git a/memcheck/mc_replace_strmem.c b/memcheck/mc_replace_strmem.c
index 7c84dbc081..28a12c517b 100644
--- a/memcheck/mc_replace_strmem.c
+++ b/memcheck/mc_replace_strmem.c
@@ -123,8 +123,8 @@ char* strncat ( char* dst, const char* src, int n )
    Int   m = 0;
 
    while (*dst) dst++;
-   while (*src && m++ < n) *dst++ = *src++;  /* concat at most n chars */
-   *dst = 0;                                 /* then add null (always) */
+   while (m   < n && *src) { m++; *dst++ = *src++; } /* concat <= n chars */
+   *dst = 0;                                         /* always add null ) */
 
    /* This checks for overlap after copying, unavoidable without
       pre-counting lengths... should be ok */
@@ -164,7 +164,7 @@ char* strncpy ( char* dst, const char* src, int n )
    if (is_overlap(dst, src, n))
       complain3("strncpy", dst, src, n);
 
-   while (*src && m++ < n) *dst++ = *src++;
+   while (m   < n && *src) { m++; *dst++ = *src++; }
    while (m++ < n) *dst++ = 0;         /* must pad remainder with nulls */
 
    return dst_orig;