Re: Possible SERIOUS bug in open()?

[deraadt () CVS OPENBSD ORG (Theo de Raadt)]

> This is far from the only
> place that I've seen problems with unexpected interactions owing to
> surprise negative arguments. Anyone want to take a guess as to what
> strncpy() does when it gets a negative "count" argument? Think that can't
> happen? Think pointer arithmetic.

Yes, but I did a 4 hour or so search in the source tree and didn't
find a single case of such a "strncpy() turning into strcpy()".

It could.  But I've not found one.  Incorrectly bounded strncat()
calls are far more common, but even then, I can't think of one of
those that we found to be exploitable.