Fix strncpy buffer overrun in obo_example.c

[Copilot]

strncpy(buffer, input, sizeof(buffer)) omits the null-terminator when input length ≥ buffer size, causing undefined behavior in subsequent printf.

Changes

• Use sizeof(buffer) - 1 in strncpy to reserve space for null-terminator
• Explicitly set buffer[sizeof(buffer) - 1] = '\0' to guarantee termination

// Before
strncpy(buffer, input, sizeof(buffer));

// After  
strncpy(buffer, input, sizeof(buffer) - 1);
buffer[sizeof(buffer) - 1] = '\0';

This prevents stack corruption when the input string is 16+ characters.

Original prompt

The obo_example.c file in the sei-vsarvepalli/simple-c repository contains an off-by-one (OBO) error in the vulnerable_function. Specifically, when using strncpy to copy user input into a buffer, the null-terminator may be omitted if the input is longer than the buffer size, leading to undefined behavior. This can potentially result in a one-byte stack overflow.\n\n### Resolution\n1. Updated the strncpy call to use sizeof(buffer) - 1 instead of sizeof(buffer) to leave room for the null terminator.\n2. Explicitly ensured null-termination by setting buffer[sizeof(buffer) - 1] = '\0'; after copying.\n\n### Modified Code\ndiff\n--- obo_example.c\n+++ obo_example.c\n@@ -5,7 +5,8 @@ void vulnerable_function(const char *input) {\n char buffer[16];\n\n // Looks safe, but is subtly wrong\n- strncpy(buffer, input, sizeof(buffer));\n+ // Ensure null-termination in all cases\n+ strncpy(buffer, input, sizeof(buffer) - 1);\n+ buffer[sizeof(buffer) - 1] = '\0';\n\n // Assumes buffer is always null-terminated\n printf("Input: %s\n", buffer);\n\n\nThis update ensures the code is secure and prevents buffer overflows.

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.