Talk:c/string/byte/strerror

strerror_s

Is there a case of undefined behavior with strerror_s? Typically, parameter bufsz specifies the size of the memory block pointed to by buf. It could erroneously be greater than that size. Then the length of the error message could be less than bufsz but greater than the length of the memory block pointed to by buf. Am I correct about this case? Newatthis (talk) 04:10, 21 August 2015 (PDT)

sure, the spec says "If the length of the desired string is less than maxsize, then the string is copied to the array pointed to by s.". That copying can access memory past the end of the array. --Cubbi (talk) 06:02, 21 August 2015 (PDT)