Can strncpy return 0?

Question

The man page of strncpy states:

char *strncpy(char *dest, const char *src, size_t n);

The strcpy() and strncpy() functions return a pointer to the destination string dest.

Is it possible that strncpy(buff, "something", 9) == 0 be true if char buff[100]?

UPDATE

I also consider it as not very probable but it's part of a program that I should make to bufferoverflow and this condition stays on my way to achieve this.

Answer 1

No.

Judging from the facts that

1. The null pointer constant NULL's value equals 0

2. A NULL pointer shall not point to a valid object. From the C11 standard, §6.3.2.3:

   [...] a null pointer [,] is guaranteed to compare unequal to a pointer to any object or function.

and that the corresponding man page does not mention the possibility of dest == NULL,
it is not allowed to.

Answer 2

Think about it. What does the man page say? It says it returns dest. Therefore, if dest is not NULL, then the return value will not be NULL.

Since buff will never be NULL (assuming it's char buff[100]), then you can say with certainty that no, it will never return NULL.

If it does, it's got a bug.

Answer 3

In my opinion if the executed code doesn't contain any undefined behavior, the given code cannot return NULL.

The only case when it can return NULL is if the destination is NULL. In such case (most likely) the execution will segfault unless the number of copied characters is 0.

In the given example:

strncpy(buff, "something", 9)

Neither the destination can be NULL ( since it is char buff[100]), nor number of copied characters can be 0 since it is given as 9.

Answer 4

According to the ISO/IEC 9899:2011 standard §7.24.2.4/c4 The strncpy: function

Synopsis

1   #include <string.h>
    char *strncpy(char * restrict s1,
    const char * restrict s2,
    size_t n);

Description

2 The strncpy function copies not more than n characters (characters that > follow a null character are not copied) from the array pointed to by s2 to the array pointed to by

3 If the array pointed to by s2 is a string that is shorter than n characters, > null characters are appended to the copy in the array pointed to by s1, until n characters in all have been written.

Returns

4 The strncpy function returns the value of s1. s1. If copying takes place between objects that overlap, the behavior is undefined.

As such, the only way for strncpy to return 0 (i.e., NULL) with out causing undefined behaviour is if s1 is NULL and n is zero.

LIVE DEMO

Answer 5

Yes strncpy() can return NULL. Just mmap a writeable page at address zero on a system that defines NULL as a pointer with zero as its numeric value:

#include <sys/mman.h>
#include <stdio.h>
#include <strings.h>

int main( int argc, char **argv )
{
    char *p;
    char *buf = mmap( ( void * ) 0, 4096,
        PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0 );
    p = strncpy( buf, "string", strlen( "string" ) );
    printf( "p: %p\n", p );
    printf( "NULL: %p\n", NULL );
    return( 0 );
}

Yes, this is intentionally violating the C standard requirement that NULL must not point to a valid object, so it's undefined behavior.

But it CAN happen.