Skip to content

fix(string): strcat does not null-terminate the result - #104

Merged
im-nymii merged 1 commit into
Auri-OS:developfrom
kudasaixc:fix/strcat-null-termination
Jul 24, 2026
Merged

fix(string): strcat does not null-terminate the result#104
im-nymii merged 1 commit into
Auri-OS:developfrom
kudasaixc:fix/strcat-null-termination

Conversation

@kudasaixc

@kudasaixc kudasaixc commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

strcat copies the bytes of src after dest but never writes the trailing \0. Any later read of the concatenated string (strlen, terminal_writestring, ...) runs past the end of the buffer into whatever garbage follows, until a stray zero byte is found. The fix writes the terminator before returning.

strcat() copies the bytes of src after dest but never writes the
trailing '\0'. Any subsequent read of the concatenated string (strlen,
terminal_writestring, ...) runs past the end of the buffer into
whatever garbage follows, until a stray zero byte is found.
@kudasaixc

kudasaixc commented Jul 4, 2026

Copy link
Copy Markdown
Contributor Author

strcat copies src after dest but never writes the terminating \0:

char dst[64];
dst[0] = '\0';
strcat(dst, "hello");
strcat(dst, "world");
terminal_writestring(dst);   // expected "helloworld"

Because the result is not terminated, terminal_writestring (which relies on strlen) keeps reading bytes past "helloworld" until it happens to hit a stray zero, leaking whatever stack/heap memory sits after the buffer onto the screen, and reading out of bounds if no zero is found.

It also breaks the second strcat: the offset walk while (dest[a] != '\0') a++; can run past the intended end for the same reason. Fix writes dest[a + b] = '\0'; before returning.

@im-nymii

Copy link
Copy Markdown
Member

LGTM !

@im-nymii
im-nymii merged commit b66ca95 into Auri-OS:develop Jul 24, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants