What should be the right usage of strncpy_s() - secure string copy - to handle all the possible corner cases?

Question

I got to know about the function - strncpy_s(), which is called the secure version of string copy. More secure than the functions - strcpy() and strncpy().

strncpy_s() is described more at this link - https://en.cppreference.com/w/c/string/byte/strncpy

I was thinking of using this function - strncpy_s() in my codebase to handle all the possible scenarios wherein its older siblings generally fail to handle - like when srcString is lengthier than destString. Or if srcString is not NULL terminated.

So I was wondering should the usage of strncpy_s() be -

strncpy_s(destString, sizeof(destString), srcString, (sizeof(srcString)>sizeof(destString)?(sizeof(destString)-1):(sizeof(srcString)-1))); - [1]

to handle all the possible scenarios gracefully - ie

1. when the srcString is greater than destString, then truncate the srcString to the length destString.
2. when the destString is greater than srcString, then copy the entire content of srcString to destString with NULL termination.
3. when both srcString and destString are of same length, then copy the entire content of srcString to destString with NULL termination.
4. when srcString is not NULL terminated. If the srcString is smaller than destString then copy the one shy of the content of srcString to the destString with NULL termination. If destString is smaller than the srcString then copy the content from srcString of the size of destString.

Can anyone think that the above mentioned usage of strncpy_s() [1] could fail in any scenario, which I am not able to think of?

Edit: I have updated the action taken in the scenario - (2), (3) and (4)

Answer 1

You should not use strncpy_s at all; it is one of the Annex K functions, which have never been implemented as an integrated part of any C library (Microsoft's compilers implement an overlapping set of functions with similar names and different semantics) and are currently being considered for removal from the standard. (For more information on this, see this old answer and the various documents it links to.)

You should instead write your own function that uses a combination of strlen, memmove, and discrete logic to implement exactly the behavior you want. You say you want the string to be truncated when the destination buffer is too small. You don't say what you want to happen when the destination buffer is at least big enough, but the obvious thing to do is copy the whole string and stop. And you also don't say what you want to happen when srcString is not NUL-terminated, but the correct thing to do in that case is to crash (see this old post from The Old New Thing about why — sorry about the absence of paragraph breaks, look for "You should crash" somewhere in the middle). Therefore:

void safe_strncpy(char *dest, size_t destsz, char *src)
{
    size_t srcsz = strlen(src);  // crash here if not nul-terminated
    if (srcsz > destsz - 1)
        srcsz = destsz - 1;
    memmove(dest, src, srcsz);   // memmove is safe if dest and src overlap
    dest[srcsz] = '\0';
}

Call just like you would call strcpy, but also providing the size of the destination buffer. Keep in mind that the size of the destination buffer is not the size of any string it may happen to have contained earlier in the program. The size of the destination buffer is the size you declared it with (if a variable) or the size you passed to malloc (if a heap allocation).

Answer 2

I strongly agree with @zwol about using not using strncpy_s().

---

I would like to offer alternative code to meet OP's objectives.

1. when the srcString is greater than destString, then truncate the srcString to the length destString.

I'd take to to also not to inspect srcString data beyond destsz elements. This has the side effect of not requiring a null character in srcString beyond destsz.

2. when the destString is greater than srcString.
3. when both srcString and destString are of same length.
4. when srcString is not NULL null character terminated.

In particular, return a clear indication of trouble in the return value.
In all cases when dest != NULL and dest > 0, dest will point to a string with a null chracter.

Below code not only addresses for OP's concerns, but also handle cases when buffers overlap by using memmove().

// Return error flag
bool sf_strncpy(char *dest, size_t destsz, const char *src) {
  // Optional pointer test
  if (dest == NULL) return true;

  // Size test
  if (destsz == 0) return true;

  // Optional pointer test
  if (src == NULL) ( dest[0] = '\0'; return true; }

  // Look for null character, but not beyond destsz
  const char *end = memchr(src, '\0', destsz);
  if (end == NULL) {
    memmove(dest, src, destsz - 1);
    dest[destsz - 1] = '\0';
    return true;
  }
  memmove(dest, src, end - src);
  return false;
}