no strcpy either

Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely … Continue reading no strcpy either →

daniel.haxx.se

"strncpy() is a weird function with a crappy API."

Well if you bother looking up that it's originally created for non null-terminated strings, then it kinda makes sense.

The real problem begun when static analyzers started to recommend using it instead of strcpy (the real alternative used to be snprintf, now strlcpy).

strlcpy is a BSD-ism that isn't in posix. The official recommendation is stpecpy. Unfortunately, it is only implemented in the documentation, but not available anywhere unless you roll your own:

https://man7.org/linux/man-pages/man7/string_copying.7.html

string_copying(7) - Linux manual page

Who cares? Just vendor it into your project. It's a tiny string manipulation function.

(I agree with the author of the piece that strlcpy doesn't actually solve the real problem.)