https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83404
Martin Sebor <msebor at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |diagnostic
Status|UNCONFIRMED |RESOLVED
CC| |msebor at gcc dot gnu.org
Resolution|--- |INVALID
--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Strncat (and strncpy) are a common source of bugs. One such common bug
involving strncat is to provide the length of the source argument rather than
the remaining space in the destination. The strncat(x, "aa", 2) call is an
example of such a common mistake. Another is strncat(x, s, strlen (s)). Yet
another is strncat(x, s, sizeof x). All are diagnosed unless GCC can prove
they are safe (which isn't always possible).
To avoid these pitfalls the guidance is to call the functions with the
remaining space in the destination, with room for the terminating nul byte.
For strncat that usually means like so:
strncat (dest, source, sizeof dest - strlen (dest) - 1);
The CERT strncpy() and strncat() article below provides more background:
https://www.us-cert.gov/bsi/articles/knowledge/coding-practices/strncpy-and-strncat.
