[Home]

Issue of the Standard # S0311

Brief

inchnstr() family of functions writes n+1 symbols in the supplied array

Detailed Description

In the standard it is declared that "the inchnstr(), mvinchnstr(), mvwinchnstr() and winchnstr() functions store at most n elements from the current or specified window into the array pointed to by chstr".
It is not clear if the terminating (chtype)0 character is included or excluded from this n characters. From Ncurses man pages it is clear that "the four functions with n as the last argument, return a leading substring at most n characters long (exclusive of the trailing (chtype)0)".
So if the array of size n is supplied to inchnstr() family of functions it will cause memory corruption.

Problem location(s) in the standard

Linux Standard Base Core Specification 3.1, Chapter 14. Utility Libraries, 14.5. Interfaces for libncurses.

Possible consequences

Memory corruption is possible if developer reads only LSB standard

References

No references to this problem found

Accepted

LSB Bugzilla, 1644

[Home]