openwall / openwall/john

Inconsistent NUL-(non)termination of zero-sized buffers by strnzcpyn (misc.c)

Open
#3,573 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

unlike the other strnz* type copy functions in misc.c, if size is 0 for this function, the dst pointer does not get null terminated. It is either a bug in this function, OR it is a bug in all the other functions (which do null terminate is size is 0).

I believe usage for all functions is this:

char buf[SIZE+1];
strnzcpy(buf, some_data, SIZE);

and that being the convension, then a 0 size SHOULD null terminate, and the strnzcpyn function should also null terminate in that case.

I listed this as a bug, (it almost certainly is). Just not sure which function the bug is in (likely it is in strnzcpyn). I think I was the one that originally wrote the strnzcpyn (due to a need for tacking size of data written), and I simply F'd this one up.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in misc.c by comparing strnzcpyn with the other strnz* copy functions, focusing on their behavior when size is zero. Determine which behavior matches the stated buffer convention, then verify that the chosen behavior is consistent across the functions and that the zero-sized destination is handled correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.