Editing Off-by-one error (section)

=== Security implications ===
A common off-by-one error which results in a security-related bug is caused by misuse of the [[C standard library]] <code>[[strncat]]</code> routine.  A common misconception with <code>strncat</code> is that the guaranteed null termination will not write beyond the maximum length.  In reality it will write a terminating null character one byte beyond the maximum length specified.  The following code contains such a bug:

<syntaxhighlight lang="c">
void foo (char *s) 
{
    char buf[15];
    memset(buf, 0, sizeof(buf));
    strncat(buf, s, sizeof(buf)); // Final parameter should be: sizeof(buf)-1
}
</syntaxhighlight>

Off-by-one errors are common in using the C library because it is not consistent with respect to whether one needs to subtract 1 byte – functions like <code>fgets()</code> and <code>strncpy</code> will never write past the length given them (<code>fgets()</code> subtracts 1 itself, and only retrieves {{nowrap|(length − 1)}} bytes), whereas others, like <code>strncat</code> will write past the length given them. So the programmer has to remember for which functions they need to subtract 1.

On some systems ([[Endianness|little endian]] architectures in particular) this can result in the overwriting of the least significant byte of the [[frame pointer]].  This can cause an exploitable condition where an attacker can hijack the local variables for the calling routine.

One approach that often helps avoid such problems is to use variants of these functions that calculate how much to write based on the total length of the buffer, rather than the maximum number of characters to write. Such functions include <code>[[strlcat]]</code> and <code>[[strlcpy]]</code>, and are often considered "safer" because they make it easier to avoid accidentally writing past the end of a buffer. (In the code example above, calling <code>strlcat(buf, s, sizeof(buf))</code> instead would remove the bug.)