Exercises — Safe alternatives — strncpy, snprintf, strlcpy

• strcpy → (c). It only stops at the source's own '\0'; it never looks at the destination size. This is the unsafe function from strcpy and sprintf (unsafe).
• strncpy → (a). Capped at n, but on a full/overflowing source it writes exactly n bytes and adds no terminator — the trap.
• snprintf → (b). Total bytes written ≤ size, and it reserves the last box for '\0', so the result is always a valid string when size > 0.

• strncpy returns dest (the pointer you passed in) — useless for detecting truncation.
• snprintf returns the number of characters it would have written, excluding the '\0'. Truncation happened iff return >= size.
• strlcpy returns strlen(src) — the full length it tried to copy. Truncation happened iff return >= size.

The pattern: snprintf and strlcpy both hand you a number you can compare against size. strncpy hands you nothing useful.

sizeof(buf) is 6 (six boxes — see sizeof vs strlen for why sizeof gives the array's box count, not the text length). The source "abc" is 3 visible chars plus its own '\0' = 4 bytes, which is shorter than n = 6. strncpy copies a b c \0, then pads the remaining boxes with '\0': $\text{’a’ ’b’ ’c’ ’0’ ’0’ ’0’}$ Valid string? Yes — box 3 holds a '\0', so strlen(buf) == 3. Safe here purely because the source was short.

"abcdef" is 6 visible chars. n = 6. strncpy copies exactly 6 bytes of content: $\text{’a’ ’b’ ’c’ ’d’ ’e’ ’f’}$ No '\0' anywhere — the source filled the entire byte budget, so there was no box left for a fence. Valid? No. strlen(buf) would run off box 5 into adjacent memory (undefined behaviour — see Memory safety and undefined behavior). Fix:

strncpy(buf, "abcdef", sizeof(buf) - 1); // cap at 5
buf[sizeof(buf) - 1] = '\0';             // box 5 = fence

Now buf = a b c d e '\0', giving the truncated string "abcde" (strlen == 5).

"val=42" is 6 visible chars, needing 7 bytes (6 + the '\0'). Only 6 boxes exist, and snprintf always reserves the last box for '\0'. So it writes 5 content chars + terminator: $\text{’v’ ’a’ ’l’ ’=’ ’4’ ’0’}$ giving buf = "val=4". r is the length it would have produced = strlen("val=42") = 6. Truncation check: $r\ge \text{size}⟺6\ge 6$ → true, truncation happened. (See Format strings and printf family for how %d expands.)

strlcpy caps content at size - 1 = 7 and always terminates: $\text{’0’ ’1’ ’2’ ’3’ ’4’ ’5’ ’6’ ’0’}$ so buf = "0123456". It returns strlen(src) = 10 (the full length it tried). $10\ge 8$ → truncation detected, in one line, for free. Contrast strncpy with the same call: it copies exactly 8 content bytes 0 1 2 3 4 5 6 7 with no terminator — an invalid string. That single difference (fence vs no fence) is the whole reason strlcpy is "the one strncpy should have been."

5 content chars + 1 terminator = 6 bytes, which is exactly sizeof(buf) = 6. Perfect fit: $\text{’h’ ’e’ ’l’ ’l’ ’o’ ’0’}$ buf = "hello". Return r = 5. Truncation check: $r\ge \text{size}⟺5\ge 6$ → false. No truncation — correct, because everything (including the fence) fit. This is the important boundary: r == size - 1 is the largest value that means "everything fit."

When size == 0, snprintf is forbidden from writing any byte at all — not even a '\0'. So buf[0] stays 'X'; the buffer is untouched. But it still computes what it would have written and returns that: strlen("hi") = 2. This is a common idiom — call snprintf(NULL, 0, fmt, ...) first to measure the needed length, then allocate exactly r + 1 bytes and call again. The measure-then-write pattern relies on this rule.

void copy_safe(char *dst, size_t dstsize, const char *src) {
    if (dstsize == 0) return;          // no room even for a fence
    strncpy(dst, src, dstsize - 1);    // cap content at C-1
    dst[dstsize - 1] = '\0';           // force the fence into the last box
}

Why each line:

• The dstsize == 0 guard: with zero boxes we cannot even write a terminator; writing dst[-1] would be an out-of-bounds write (Buffer overflow and stack smashing).
• strncpy(..., dstsize - 1): reserves the last box, so strncpy can never touch box dstsize - 1.
• dst[dstsize - 1] = '\0': unconditionally places the fence. If the source was long, this truncates; if short, this box was already '\0' from padding — either way it's correct.

char out[16];
const char *name = "alexandra";       // 9 chars
int r = snprintf(out, sizeof(out), "user=%s", name);
int truncated = (r >= (int)sizeof(out));

"user=alexandra" is 5 + 9 = 14 chars, needing 15 bytes. sizeof(out) = 16, so it fits with room to spare: $\text{out = "user=alexandra"},r=14$ truncated = (14 >= 16) = false (0). Correct — no data lost. Note the (int) cast: sizeof yields an unsigned size_t; comparing a signed r against it without the cast can misbehave if r were ever negative (an encoding error). Casting makes the comparison honest.

char out[9];
int r = snprintf(out, sizeof(out), "%s-%s", "hello", "world");

The full result "hello-world" is 5 + 1 + 5 = 11 chars, needing 12 bytes. Only 9 boxes exist, and snprintf reserves the last for '\0', so it writes 8 content chars + fence: $\text{’h’ ’e’ ’l’ ’l’ ’o’ ’-’ ’w’ ’o’ ’0’}$ out = "hello-wo". Return r = 11 (the wanted length). Truncation: $11\ge 9$ → true. A correct buffer needs r + 1 = 12 bytes. This is the measure trick: r tells you exactly how big to make it next time.

size_t need = strlen(src) + 1;   // +1 for the '\0' fence
char *dst = malloc(need);
memcpy(dst, src, need);          // copy content AND the terminator

Why this is bulletproof:

• strlen(src) counts visible chars (stops at src's own '\0'), so need is exactly content + fence.
• malloc(need) allocates precisely that many boxes — no overflow possible because the buffer was sized from the data.
• memcpy(dst, src, need) copies need bytes, and since box need - 1 of src is its '\0', the fence is copied too. No manual termination needed.
• Uses only standard functions → portable everywhere, no strlcpy dependency. This is the "size the cup to the water" strategy — the inverse of "pour into a fixed cup," and it never truncates.

Source "1234567" is 7 content chars, needing 8 bytes total (7 + fence). b has exactly 8 boxes — an exact fit.

The subtle point: here even strncpy produces a valid string! The source "1234567" is 7 chars; strncpy copies 7 content bytes and has 1 byte left, which it fills with the source's own '\0', then pads (nothing left to pad). It succeeds only because the content was n - 1 bytes, not n. Push the source to 8 chars and strncpy breaks while the other two stay safe. snprintf/strlcpy return 7; since $7<8$, no truncation flagged — correct, everything fit.

"n forgets the knot; printf and l always tie it." One extra argument — the destination size — is the whole safety story. The size answers "how big is the cup?" Never skip it. And the fence rule: content ≤ capacity − 1, always.