[STDCXX-68] [MSVC 8.0] strxfrm(s1, s2, 0) writes past the end of the destination buffer

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 4.1.2
• Component/s: External

Environment

MSVC 8

• Assignee: Martin Sebor
• Reporter: Martin Sebor
• Created: 19/Nov/05 09:50
• Updated: 01/Oct/07 16:13

Description

From
http://lab.msdn.microsoft.com/ProductFeedback/viewfeedback.aspx?feedbackid=b41c0882-79d0-412b-b404-d9ecb1952c31
======================================================================
Bug ID: FDBK40793
Problem Type: Bug
Status: New
Microsoft Status: Under Review
Opened Date: 2005-11-18 16:06:05
Opened By: Martin Sebor
Product/Technology: Visual C++
Version: Visual Studio 2005
Product Language: English
Category: Libraries
OS: Windows 2000 Server
OS Language: US English
Submission Language: English
======================================================================
Description:
Opened by Martin Sebor on 2005-11-18 at 16:06:05

The C standard library function strxfrm() writes past the end of the destination
buffer.

======================================================================
Steps to Reproduce:

$ cat t.cpp && cl t.cpp && ./t.exe
#include <assert.h>
#include <locale.h>
#include <string.h>

int main ()
{
setlocale (LC_COLLATE, "CAT");

char s1 [2] =

{ '*', '*' }

;
strxfrm (s1, "", 0);
assert ('' == s1 [0] && '' == s1 [1]);
}
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.42 for 80x86
Copyright (C) Microsoft Corporation. All rights reserved.

t.cpp
Microsoft (R) Incremental Linker Version 8.00.50727.42
Copyright (C) Microsoft Corporation. All rights reserved.

/out:t.exe
t.obj
Assertion failed: '' == s1 [0] && '' == s1 [1], file t.cpp, line 11

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
======================================================================
Actual Results: Runtime error.
Expected Results: No error.

Issue Links

• relates to: STDCXX-69 [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer