Re: Administrivia: List Announcement

[Eric Haugh <haugh () cs ucdavis edu>]

> >        strncpy(buf2, p2, SIZE);
>
> Off-by-one. Third arg should be SIZE-1 to leave room for the terminating
> NULL. This error should lead to a heap based vulnerability when the
> memory is free()d.

Even if this is changed to:

strncpy(buf2, p2, SIZE - 1);

it is still not safe, because stnrcpy will not write the terminating NULL 
character if p2 is of length SIZE - 1 or more.  So this can leave the string 
in buf2 unterminated.  It should be:

strncpy(buf2, p2, SIZE);  // or strncpy(buf2, p2, SIZE - 1), doesn't matter
buf2[SIZE - 1] = '\0';

Or better yet:

strlcpy(buf2, p2, SIZE);

Eric