What security issues exist with this strncpy?

Question

Possible Duplicate:
Why is strncpy insecure?

What are the security issues with strncpy():

   function foo(char * param) {
   char local[100];
     /* do stuff */
   strncpy(local, param, strlen(param));
     /* do more stuff */
   }

Answer 1

Normally, the maximum length (3'rd) parameter to strncpy(3) would be the size of the destination, not the size of the source. There is really no point in limiting the transfer to the size of the source, as that is the maximum that would have been transferred with the more dangerous plain strcpy(3).

And, to answer the question, the problem is that this is not a memory-safe operation, so an attacker could supply a string longer than the buffer which would overwrite code on the stack, and if carefully arranged, could execute arbitrary code from the attacker.