Safe memory, better error messages, mostly ignored.
See #46.
Applied to strcat_s, strncat_s

to be used later overall.
we can now statically append __FUNCTION__ to the msg (which
we always never need), avoiding sprintf.

See #46 which might decide that the memory win of the func prefix
in combined const .cstrings with sprintf will be better.

Change diagnose_if to be in clang-7

some checks do not need BOS.
checks all other source, length and value overflows.
since clang-5 the library checks now all possible overflows at compile-time!

Just for testing. Will be later moved to safeclib_private.h macros.

Unfortunately __FUNCTION__ fails under strict ISO C with
-Werror=pedantic,
which we don't use in the tests. But for the src write it out.

to make warn-dmax fatal

and foresee an --enable-error-dmax/HAVE_ERROR_DMAX option.
See GH #40

we need a matching GCC_DIAG_RESTORE when GCC_DIAG_NOUSERWARN
is not available

and GCC_DIAG_NOUSERWARN, to selective disable some
Wrong dmax warnings in the tests.

We cannot add -D_FORTIFY_SOURCE=2 to --enable-debug, because clang has a
builtin logic to disable it on -DDEBUG, which will lead to an
-Werror,-Wmacro-redefined error.

for -Wno-gcc-compat and -Wno-error=user-defined-warnings

via ifndef HAVE_CT_BOS_OVR
The new compile-time diagnose_if overflow check since clang-7

add configure probe --enable-warn-dmax, independent on
_FORTIFY_SOURCE>1, because we want to test it also, and tests can be slow.

warn when dmax != sizeof(dest),
error when dmax > sizeof(dest).

not just our internal config.h header.
The user needs to BOS_CHK his calls to our safeclib functions.

Add it to the mem functions also.
Include safe_types.h (with the BOS defs) before safe_str_lib.h

sizeof(dest)!=dmax checks as user-defined warnings (clang).
when __builtin_object_size returns the known object size.
See GH #40

e.g.:
test_strcoll_s.c:81:39: warning: wrong dmax [-Wuser-defined-warnings]
    rc = strcoll_s(str1, 0, str2, &ind);

There is a nice 2013 book out there:
"Secure Coding in C and C++: Strings and Buffer Overflows"

we also test now wine-3.0, and add/clarify the recently added smokers

Wrong copy&paste constant

with an empty name

-mretpoline is currently the clang-7.0 name for Spectre mitigation.
gcc-7.3/8.1 branches currently use -mindirect-branch=thunk-extern for this.
The default GNU linker check does not work though, you need llvm lld-7.
so add -Wl,-z,retpolineplt only where the retpoline spectre option was added.
Without linker support don't add the cflags neither, but warn.
It needs lld-7 via LDFLAGS=-fuse-ld=lld-7

There is also a new -Wl,-z,textonly option.
https://sourceware.org/ml/binutils/2017-11/msg00369.html
Probe for it also.

with *printf_s and *scanf_s.
e.g. https://github.com/wine-mirror/wine/blob/master/dlls/msvcrt/file.c#L5378

msvcrt doesn't even check for src==NULL.

there's no mingw cross-specific define, when running under WINE
so we need to add one. Just used for testing.

now all TEST_MSVCRT tests pass under mingw native and wine-2 (darwin).

as it is done on wine and msvcrt

when cross-compiling to mingw (32bit)

add missing native msvcrt checks to all tests,
and the ifdef TEST_MSVCRT to the sources.

probe for all our C11 Annex K functions,
but add TEST_MSVCRT checks only to those which are defined
on mscvrt currently (on my win8 machine). maybe newer ucrt.dll
versions add even more. TBD

add cross-smoking for TEST_MSVCRT via wine 32bit.  The wine libc runtime is
a bit older than the current msvcrt and has much more bugs.

add have_wine logic, where it has a broken libc: wcsncat_s, wcsrtombs_s,
asctime_s. More in later commits.

also on macports but here --disable-shared.
no test fails.

superceded by build-tools/gcov.sh via case `uname`

needs gcc-arm-linux-gnueabihf and qemu-arm

32bit arm hard-float (ARMv7 with Thumb-2) gcc and glibc.

several test errors still:
t_wcscmp_s, t_wcsicmp_s, t_wcsncmp

use now the native vsnprintf_s function to reject illegal format
specifiers.
vsnprintf permits those.

Closes GH #45

See GH #45.
In this case I (and all others) think the standard made an error.
All existing implementations do return -1 on errors, all similar functions do return -1.
The revision and rationale for this change is: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1141.pdf
keeping count += sprintf(buf + count, format_string, args); valid, when no encoding errors can occur.
google site:www.open-std.org vsprintf_s.

Even Microsoft itself, who changed this behaviour in the standard with n1141, changed it later
back to return -1 consistently.
Document the deviation, and test it against msvcrt.

Previously a placeholder for gcov post-process fixups,
now the preferred configure options, to recreate the very exact
test stats, on darwin. On linux the linenumbers and percentages
are a bit off. It has less native helpers.

with native memccpy(str1, str2, 0, 0) on musl the return value is
a copy of str1, but str1 is cleared.

Thanks to @peiliu, Closes #44. No NULL as va_list in the test.
Coverage still the same.

change the slen=0 logic to match msvcrt and strncat_s.
only EOK when dest is valid.

and simplify the CHECK_SLACK logic.
with TEST_MSVCRT we ensure compile-time use_msvcrt again.

verify that our new implementation really conforms to
msvcrt, sans null-slack, and different RSIZE_MAX.

reactos does have a different n=0 logic.

note that the spec leaves null-slack unspecified,
http://en.cppreference.com/w/c/string/wide/wcsncpy specifies
that NO slacking may occur. only wcsncpy does null-slacking.
well, we prefer the spec and consistency.

verify that our new implementation really conforms to
msvcrt. reactos does have a different n=0 logic.