Bug in fmemopen() or my program?

[Dustin Boyd]

I have the following program:

#include <stdio.h>
#include <string.h>

#define BYE "goodbye"
#define SIZE (sizeof (BYE) - 1)

int
main (void)
{
  char buf[SIZE];
  FILE* f;
  size_t nwr, len;

  f = fmemopen (buf, SIZE, "w+");
  nwr = fwrite (BYE, 1, SIZE, f);
  fclose (f);
  len = strnlen (buf, SIZE);

  printf ("siz %zu\n", SIZE);
  printf ("nwr %zu\n", nwr);
  printf ("len %zu\n", len);
  printf ("buf %.*s\n", (int) len, buf);
}


Output:
     Debian  Fedora  FreeBSD
siz  7       7       7
nwr  7       7       7
len  6       6       7
buf  goodby  goodby  goodbye

According to the Single Unix Specification, a null byte is only
written at the end of the buffer on flush/close when there is space
left in the buffer.

I wrote 7 bytes as indicated by the return value of fwrite(), and the
size of the buffer is 7 bytes, so no space remains in the buffer.

Why is a null byte being written here?  Am I overlooking something
important about fmemopen(), or is it a bug in glibc's implementation?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 509 bytes
Desc: OpenPGP digital signature
URL: <https://sourceware.org/pipermail/libc-help/attachments/20200918/26912c68/attachment.sig>