4 ms·
Are you sure that strncpy does an out-of-bound write here? I believe it doesnt, but would give you an unterminated string in buf which is also... less than idea
by myrmidon 4y ago
Are you sure that strncpy does an out-of-bound write here? I believe it doesnt, but would give you an unterminated string in buf which is also... less than ideal (if the input is 80 non-null characters or longer).
- nneonneo 4y agoUgh, I had that in my comment before I "refactored" it. Fixed now, thanks for pointing it out.
- Lt_Riza_Hawkeye 4y agoYeah, and I wouldn't say it's definitely unsafe. You can memchr a '\0' out of it (or not) to determine if a null terminator got in there or not.
- nneonneo 4y agoI mean, you could but a lot of people do not. Plus, strncpy is terribly inefficient if the source string is tiny, because it’ll fill the rest of the buffer with NULs.
- myrmidon 4y agoOne mans inefficiency is another mans resistance to timing attacks :P (this is tongue-in-cheek, the function is still bad IMO because it almost never does what you need it to. If it guaranteed null termination it would be more useful)