[open-source] Re: Wish for 2002 ...

[Martin v. Loewis]

> It is lamentable that there has been some divergence, but that doesn't
> mean one has to freeze, paralyzed with indecision, and do nothing.  The
> original Usenix paper, which in the absence of formal standardization is
> the closest thing we have to a standard, specified the semantics in some
> detail; is there a question it does not answer?

After reading the paper, I find that the border cases of overlapping
strings for strlcat is not specified. I can see two scenarios:

   a) src is a substring of dst, such as
      strlcat(msg, msg, buffersize(msg));

   b) src is in the free space after dst, such as 
      strlcat(msg, msg+strlen(msg)+5, buffersize(msg));

Furthermore, the exact meaning of the return value *is* troubling. The
paper did not consider the case that dst is not null-terminated within
siz; the current BSD implementation does (but changes the meaning of
the return value). The case that src is not null-terminated is not
considered at all.

Regards,
Martin