This message is trying to warn you that you’re doing exactly what you’re doing. A lot of the time, that’s not what the programmer intended. If it is what you intended (meaning, your code will correctly handle the case where the character array will not end up containing any null character), turn off the warning. … Read more
Take a look at this site; it’s a fairly detailed explanation. Basically, strncpy() doesn’t require NUL termination, and is therefore susceptible to a variety of exploits.
Firstly, strlcpy has never been intended as a secure version of strncpy (and strncpy has never been intended as a secure version of strcpy). These two functions are totally unrelated. strncpy is a function that has no relation to C-strings (i.e. null-terminated strings) at all. The fact that it has the str… prefix in its … Read more
strncpy() is not intended to be used as a safer strcpy(), it is supposed to be used to insert one string in the middle of another. All those “safe” string handling functions such as snprintf() and vsnprintf() are fixes that have been added in later standards to mitigate buffer overflow exploits etc. Wikipedia mentions strncat() … Read more
The strncpy() function was designed with a very particular problem in mind: manipulating strings stored in the manner of original UNIX directory entries. These used a short fixed-sized array (14 bytes), and a nul-terminator was only used if the filename was shorter than the array. That’s what’s behind the two oddities of strncpy(): It doesn’t … Read more