* string/bug-stpncpy-offend.c: New file.

	* string/Makefile (tests): Add it.

2 files changed, 55 insertions, 2 deletions

diff --git a/string/Makefile b/string/Makefile
index 5d5b09e..b0f5571 100644
--- a/string/Makefile
+++ b/string/Makefile
@@ -1,4 +1,4 @@
-# Copyright (C) 1991-1999, 2000, 2001 Free Software Foundation, Inc.
+# Copyright (C) 1991-1999,2000,2001,2002 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 
 # The GNU C Library is free software; you can redistribute it and/or
@@ -48,7 +48,7 @@ o-objects.ob	:= memcpy.o memset.o memchr.o
 tests		:= tester inl-tester noinl-tester testcopy test-ffs	\
 		   tst-strlen stratcliff tst-svc tst-inlcall		\
 		   bug-strncat1 bug-strspn1 bug-strpbrk1 tst-bswap	\
-		   tst-strtok tst-strxfrm bug-strcoll1
+		   tst-strtok tst-strxfrm bug-strcoll1 bug-stpncpy-offend
 distribute	:= memcopy.h pagecopy.h tst-svc.expect
 
 
diff --git a/string/bug-stpncpy-offend.c b/string/bug-stpncpy-offend.c
new file mode 100644
index 0000000..3a782f7
--- /dev/null
+++ b/string/bug-stpncpy-offend.c
@@ -0,0 +1,53 @@
+/* Test program for stpncpy reading off the end of the source string.  */
+
+#include <string.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+static int do_test (void);
+#define TEST_FUNCTION do_test ()
+#include <test-skeleton.c>
+
+static int
+do_test (void)
+{
+  /* We get two pages of memory and then protect the second one so
+     we are sure to fault if we access past the end of the first page.
+     Then we test the odd-size string ending just on the page boundary.  */
+
+  static const char test_string[] = "Seven.";
+  const size_t pagesz = getpagesize ();
+  char *buf = mmap (NULL, pagesz * 2,
+		    PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
+  char *s1, *r;
+  volatile size_t len = sizeof test_string;
+
+  if (buf == MAP_FAILED)
+    {
+      perror ("mmap");
+      return 1;
+    }
+  if (mprotect (buf + pagesz, pagesz, PROT_NONE) != 0)
+    {
+      perror ("mprotect");
+      return 2;
+    }
+
+  s1 = buf + pagesz - sizeof test_string;
+  memcpy (s1, test_string, sizeof test_string);
+
+  r = stpncpy (buf, s1, len);
+  if (r != buf + len - 1)
+    {
+      printf ("r = buf + %d != %zu\n", r - buf, len - 1);
+      return 3;
+    }
+  r = stpncpy (s1, buf, len);
+  if (r != s1 + len - 1)
+    {
+      printf ("r = s1 + %d != %zu\n", r - s1, len - 1);
+      return 3;
+    }
+
+  return 0;
+}