strncpy doesn't always null-terminate

Question

I am using the code below:

char filename[ 255 ];
strncpy( filename, getenv( \"HOME\" ), 235 );
strncat( filename, \"/.config/stationlist.xml\", 255 );
         


        

Answer 1

You may overflow filename with your strncat call.

Use:

strncat(filename, "/.config/stationlist.xml",
        sizeof filename - strlen(filename) - 1);

Also be sure to null terminate your buffer after strncpy call:

strncpy( filename, getenv( "HOME" ), 235 );
filename[235] = '\0';

as strncpy does not null terminate its destination buffer if the length of the source is larger or equal than the maximum number of character to copy.