Edit: I\'ve added the source for the example.
I came across this example:
char source[MAX] = \"123456789\";
char source1[MAX] = \"12
strncpy fills the destination up with '\0' for the size of source, eventhough the size of the destination is smaller....
manpage:
If the length of src is less than n, strncpy() pads the remainder of dest with null bytes.
and not only the remainder...also after this until n characters is reached. And thus you get an overflow... (see the man page implementation)