I have encountered "Buffer overflow-array index out of bounds" error

Question

I do understand the error but don't know what is the proper solution for this. It says

Array 'filename' of size 512 may use index value(s) MIN..1022

Is it because strncat is called right after strncpy?

I tried doing strlen, but that introduced some other errors.

#define MAX_SIZE 512
void some_function(const char *path)        /*path is also char  
                                             array of size 512*/  
{

    char filename[MAX_SIZE]="";
    char *attr = "/funct";

    strncpy(filename, path, sizeof(filename));
    strncat(filename, attr, sizeof(filename));  //error line

}

Is there any proper solution for this.

`path` is considered an `int`. Declare as: `void some_function(char *path)`. — Paul Ogilvie, Jul 17 '19 at 17:29
`strncpy` does not terminate the copied string if more is attempted to be copied than the size parameter. `strncat` will then atempt to search the end, but there may not be a terminating null character. — Paul Ogilvie, Jul 17 '19 at 17:30
In the `strncat` call you have to specify the remaining space, something like `sizeof(filename)-strlen(filename)`. — Bodo, Jul 17 '19 at 17:32
and please note that a) `strncpy()` doesn't write a `'\0'` to `filename` if `strlen(PATH) >= MAX_SIZE` and b) `strncat()` appends up to another `MAX_SIZE` characters to `filename` thus potentially exceeding the array size — Ingo Leonhardt, Jul 17 '19 at 17:33
To terminate the `strncpy`d string: `filename[sizeof(filename)-1]= '\0';` — Paul Ogilvie, Jul 17 '19 at 17:34
@paul: filename array is fully initialized with 0's in the above case. — machine_1, Jul 17 '19 at 17:43

Vlad from Moscow · Answer 1 · 2019-07-17T18:17:51.553

If you are using the function strncpy then you have to set its last character to the zero character '\0'. Otherwise you can not guarantee that the character array contains a string.

Using strncat this way

strncat(filename, attr, sizeof(filename));

does not make sense. The array filename can have no enough space to accommodate the string attr. But you are trying to copy sizeof(filename) characters to an array that already can be entirely filled.

You have to check "manually" whether the destination array contains enough space to append a new string to the already stored string.

So there is no sense to use the function strncat because in any case the result path will be invalid.

You can use the following approach shown in the demonstrative program below.

#include <stdio.h>
#include <string.h>

#define MAX_SIZE 512

void some_function(const char *path )
{
    char filename[MAX_SIZE] = "";
    const char *attr = "/funct";
    size_t n = strlen( attr );

    strncpy( filename, path, sizeof (filename ) );

    filename[ MAX_SIZE - 1] = '\0';

    if ( n < MAX_SIZE - strlen( filename ) )
    {
        strcat( filename, attr ); 
    }

    puts( filename );
}

int main(void) 
{
    const char *path = "/path";

    some_function( path );

    return 0;
}

Or you could at the very beginning of the function check whether the array can contain the both strings. For example

#include <stdio.h>
#include <string.h>

#define MAX_SIZE 512

void some_function(const char *path )
{
    char filename[MAX_SIZE] = "";
    const char *attr = "/funct";
    size_t n1 = strlen( path );
    size_t n2 = strlen( attr );

    if ( n1 + n2 < MAX_SIZE )
    {
        strcpy( filename, path );

        strcpy( filename + n1, attr ); 
    }

    puts( filename );
}

int main(void) 
{
    const char *path = "/path";

    some_function( path );

    return 0;
}

score 0 · Answer 2 · answered Jul 17 '19 at 18:24

The error message of the compiler is probably because you copy a maximum of 511 bytes (plus null) and then concatenate another maximum of 511 bytes (plus null), a total of 1022 bytes (plus one null).

However, the compiler sees the target is only 512 bytes and issues a warning.

Solutions are given in comments and in other solutions, which I do not repeat here.

I have encountered "Buffer overflow-array index out of bounds" error

2 Answers2