Re: WuFTPD: Providing *remote* root since at least1994

[hno () HEM PASSAGEN SE (Henrik Nordstrom)]

der Mouse wrote:

> And - IMO, of course - an snprintf that doesn't NUL-terminate is past
> that point.

Unless it at the same time returns an error, which I presume most do
when they have to truncate the result. In case of error it can and
should be expected that the result is a bit undefined..

I have so far seen four alternatives:

a) Returns -1 and raw truncate without \0

b) Returns -1 and truncate with a \0

c) Returns the total needed amount of characters and truncate with a \0

d) snprintf not existing at all

So you should be safe if you properly handle the error status of
snprintf and act upon it either by growing the buffer as needed or
making sure that the result is \0 terminated, or if you include your own
version unless the target system is detected to be of type (b) or (c).

--
Henrik Nordstrom