Edit: I've added the source for the example.

I came across this example:

char source[MAX] = "123456789";
char source1[MAX] = "123456789";
char destination[MAX] = "abcdefg";
char destination1[MAX] = "abcdefg";
char *return_string;
int index = 5;

/* This is how strcpy works */
printf("destination is originally = '%s'\n", destination);
return_string = strcpy(destination, source);
printf("after strcpy, dest becomes '%s'\n\n", destination);

/* This is how strncpy works */
printf( "destination1 is originally = '%s'\n", destination1 );
return_string = strncpy( destination1, source1, index );
printf( "After strncpy, destination1 becomes '%s'\n", destination1 );

Which produced this output:

destination is originally = 'abcdefg'
After strcpy, destination becomes '123456789'

destination1 is originally = 'abcdefg'
After strncpy, destination1 becomes '12345fg'

Which makes me wonder why anyone would want this effect. It looks like it would be confusing. This program makes me think you could basically copy over someone's name (eg. Tom Brokaw) with Tom Bro763.

What are the advantages of using strncpy() over strcpy()?

  • 72
    I think you meant to ask "Why on earth would anyone use strcpy instead of strncpy?" – Sam Harwell Aug 11 '09 at 5:24
  • 4
    When I was a TA for a first semester programming course in C, I assured my students that any usage of methods like getline would result in incorrect results when I graded them against carefully crafted inputs. :) – Sam Harwell Aug 11 '09 at 5:31
  • 4
    I think you've misunderstood what the code actually does. Take a closer look. – Emil H Aug 11 '09 at 5:44
  • 4
    It is really a pity C never got a half-decent standard library for strings. – starblue Aug 11 '09 at 6:06
  • 6
    it's not THAT much of a pity. I mean, it totally broke me in, and made higher level languages MUCH more fun :) – Carson Myers Aug 11 '09 at 8:05

10 Answers 10

up vote 79 down vote accepted

strncpy combats buffer overflow by requiring you to put a length in it. strcpy depends on a trailing \0, which may not always occur.

Secondly, why you chose to only copy 5 characters on 7 character string is beyond me, but it's producing expected behavior. It's only copying over the first n characters, where n is the third argument.

The n functions are all used as defensive coding against buffer overflows. Please use them in lieu of older functions, such as strcpy.

  • 39
    See lysator.liu.se/c/rat/d11.html : strncpy was initially introduced into the C library to deal with fixed-length name fields in structures such as directory entries. Such fields are not used in the same way as strings: the trailing null is unnecessary for a maximum-length field, and setting trailing bytes for shorter names to null assures efficient field-wise comparisons. strncpy is not by origin a "bounded strcpy," and the Committee has preferred to recognize existing practice rather than alter the function to better suit it to such use. – Sinan Ünür Aug 11 '09 at 6:20
  • 31
    I am not sure why this is getting lots of up votes - strncpy was never intended as a safer alternative to strcpy and in fact isn't any safer as it doesn't zero termninate the string. It also has different functionality in that it pads up the supplied length with NUL chars. As caf says in his reply - it is for overwriting strings in a fixed size array. – Dipstick Aug 11 '09 at 6:25
  • 6
    @chris & Sinan: It's getting upvotes because the question was, "Why would you use strncpy instead of strcpy?" Not, "What is strncpy for?" There's a distinct difference. This answer addresses the former, not the latter. – Eric Aug 11 '09 at 6:29
  • 20
    The fact remains that strncpy is not a safer version of strcpy. – Sinan Ünür Aug 11 '09 at 6:33
  • 6
    @Sinan: I never said it was safer. It's defensive. It forces you to put in a length, ergo making you think about what you're doing. There are better solutions, but the fact remains that people would (and do) use strncpy instead of strcpy because it's a much more defensive function...which is what I said. – Eric Aug 11 '09 at 6:36
up vote 145 down vote
+50

The strncpy() function was designed with a very particular problem in mind: manipulating strings stored in the manner of original UNIX directory entries. These used a fixed sized array, and a nul-terminator was only used if the filename was shorter than the array.

That's what's behind the two oddities of strncpy():

  • It doesn't put a nul-terminator on the destination if it is completely filled; and
  • It always completely fills the destination, with nuls if necessary.

For a "safer strcpy()", you are better off using strncat() like so:

if (dest_size > 0)
{
    dest[0] = '\0';
    strncat(dest, source, dest_size - 1);
}

That will always nul-terminate the result, and won't copy more than necessary.

  • But, of course, strncpy isn't always what you want either: strncpy accepts the maximum number of characters to add and not the destination buffer size... But that's only a minor thing, so probably won't be an issue unless you're trying to concatenate one string onto another. – David Wolever Aug 11 '09 at 23:59
  • I did not know the reason for it, and it's very relevant to what I'm working on atm. – Matt Joiner Sep 21 '10 at 16:18
  • I always wondered why strncpy is so strange. thx – Prof. Falken Nov 15 '11 at 8:19
  • The strncpy() function is designed to store strings in fixed-length null-padded format. Such a format was used for the original Unix directory entries, but is used in countless other places as well, since it allows a string of 0-N bytes to be stored in N bytes of storage. Even today, many databases use null-padded strings in their fixed-length string fields. The confusion with strncpy() stems from the fact that it converts strings to FLNP format. If what one needs is an FLNP string, that's wonderful. If one needs a null-terminated string, one must provide the termination oneself. – supercat Nov 20 '11 at 23:26
  • I don't understand "accepts the maximum number of characters to add and not the destination buffer size" - it doesn't accept either, it accepts an integer: It touches exactly n characters of the dest, and no more. It examines (and copies) characters from the source until it has copied n, or until it encounters a NUL - it never examines more than n characters from the source. – Spike0xff Oct 5 '15 at 20:12

While I know the intent behind strncpy, it is not really a good function. Avoid both. Raymond Chen explains.

Personally, my conclusion is simply to avoid strncpy and all its friends if you are dealing with null-terminated strings. Despite the "str" in the name, these functions do not produce null-terminated strings. They convert a null-terminated string into a raw character buffer. Using them where a null-terminated string is expected as the second buffer is plain wrong. Not only do you fail to get proper null termination if the source is too long, but if the source is short you get unnecessary null padding.

See also Why is strncpy insecure?

strncpy is NOT safer than strcpy, it just trades one type of bugs with another. In C, when handling C strings, you need to know the size of your buffers, there is no way around it. strncpy was justified for the directory thing mentioned by others, but otherwise, you should never use it:

  • if you know the length of your string and buffer, why using strncpy ? It is a waste of computing power at best (adding useless 0)
  • if you don't know the lengths, then you risk silently truncating your strings, which is not much better than a buffer overflow
  • I think this is a good description for strncpy, so I have voted it up. strncpy has it's own set of troubles. I guess that's the reason that e.g glib has it's own extensions. And yes it's unfortunate that you as programmmer has to be aware of the Size of all the arrays. The decison having 0 terminated char array as string, has cost us all dearly.... – Friedrich Oct 21 '09 at 16:04
  • Zero-padded strings are a pretty common when storing data in fixed-format files. To be sure, the popularity of things like database engines and XML, along with evolving user expectations, have caused fixed-format files to be less common than they were 20 years ago. Nonetheless, such files are often the most time-efficient means of storing data. Except when there's a huge disparity between the expected and maximum length of a data in a record, it's much faster to read a record as a single chunk that contains some unused data than to read a record divided into multiple chunks. – supercat Nov 20 '11 at 23:39
  • Just took over maintenance of legacy code, which used g_strlcpy(), so does not suffer the padding inefficiencies, but sure enough, the count of bytes transferred was NOT maintained, so the code was silently truncating the result. – user2548100 Jan 28 '14 at 19:37

What you're looking for is the function strlcpy() which does terminate always the string with 0 and initializes the buffer. It also is able to detect overflows. Only problem, it's not (really) portable and is present only on some systems (BSD, Solaris). The problem with this function is that it opens another can of worms as can be seen by the discussions on http://en.wikipedia.org/wiki/Strlcpy

My personal opinion is that it is vastly more useful than strncpy() and strcpy(). It has better performance and is a good companion to snprintf(). For platforms which do not have it, it is relatively easy to implement. (for the developement phase of a application I substitute these two function (snprintf() and strlcpy()) with a trapping version which aborts brutally the program on buffer overflows or truncations. This allows to catch quickly the worst offenders. Especially if you work on a codebase from someone else.

EDIT: strlcpy() can be implemented easily:

size_t strlcpy(char *dst, const char *src, size_t dstsize)
{
  size_t len = strlen(src);
  if(dstsize) {
    size_t bl = (len < dstsize-1 ? len : dstsize-1);
    ((char*)memcpy(dst, src, bl))[bl] = 0;
  }
  return len;
}
  • 3
    You could write that strlcpy is available on pretty much everything other than Linux and Windows! It is, however, BSD licensed, so you can just drop it into one of your libraries and use it from there. – Michael van der Westhuizen Aug 11 '09 at 8:07
  • You might want to add a test for dstsize > 0 and do nothing if it is not. – chqrlie Feb 5 '16 at 19:19
  • Yes, you're right. I will add the check as without it a dstsize will trigger the memcpy of length len on the destination buffer and overflowing it. – Patrick Schlüter Feb 8 '16 at 8:05
  • Plus one for promoting good solutions. More people need to know about strlcpy because everyone keeps reinventing it poorly. – rsp Jun 26 '16 at 6:16
  • @MichaelvanderWesthuizen It is available on Linux, just not in glibc. See my answers for more info (1) (2) (3) – rsp Jun 26 '16 at 6:19

The strncpy() function is the safer one: you have to pass the maximum length the destination buffer can accept. Otherwise it could happen that the source string is not correctly 0 terminated, in which case the strcpy() function could write more characters to destination, corrupting anything which is in the memory after the destination buffer. This is the buffer-overrun problem used in many exploits

Also for POSIX API functions like read() which does not put the terminating 0 in the buffer, but returns the number of bytes read, you will either manually put the 0, or copy it using strncpy().

In your example code, index is actually not an index, but a count - it tells how many characters at most to copy from source to destination. If there is no null byte among the first n bytes of source, the string placed in destination will not be null terminated

strncpy fills the destination up with '\0' for the size of source, eventhough the size of the destination is smaller....

manpage:

If the length of src is less than n, strncpy() pads the remainder of dest with null bytes.

and not only the remainder...also after this until n characters is reached. And thus you get an overflow... (see the man page implementation)

  • 3
    strncpy fills the destination up with '\0' for the size of source, eventhough the size of the destination is smaller.... I'm afraid this statement is erroneous and confusing: strncpy fills the destination up with '\0' for the size argument, if the length of the source is less. The size argument is not the size of the source, not a maximum number of characters to copy from the source, as it is in strncat, it is the size of the destination. – chqrlie Feb 5 '16 at 19:21
  • @chqrlie: Exactly. An advantage of strncpy over other copy operations is that it guarantees that the entire destination will be written. Since compilers may try to get "creative" when copying structures containing some Indeterminate Values, ensuring that any character arrays within structures get written fully may be the simplest way to prevent "surprises". – supercat Apr 15 '17 at 16:34
  • @supercat: a very small advantage for this specific case... but the destination must be patched after the call to strncpy to ensure null termination: strncpy(dest, src, dest_size)[dest_size - 1] = '\0'; – chqrlie Apr 16 '17 at 20:17
  • @chqrlie: Whether or not a trailing null byte would be required would depend upon what the data is supposed to represent. Using zero-padded rather than zero-terminated data within a structure isn't as common as it used to be, but if e.g. an object-file format uses 8-byte section names, being able to have a char[8] within a structure handle things up to 8 characters may be nicer than using a char[8] but only being able to handle 7 characters, or having to copy a string into char[9] buffer and then memcpy it to the destination. – supercat Apr 16 '17 at 20:32
  • @chqrlie: Most code that does things with strings should know how long they might be, and shouldn't blindly run with char pointers until they hit a zero. The only thing zero-terminated strings are really good for is string literals, and even there a variable-length-encoded prefix would probably be better. For almost everything else, it would be better to have strings either prefixed with a length or have a special prefix which would indicate that the char* is really something like struct stringInfo {char header[4]; char *realData; size_t length; size_t size;}. – supercat Apr 16 '17 at 20:37

This may be used in many other scenarios, where you need to copy only a portion of your original string to the destination. Using strncpy() you can copy a limited portion of the original string as opposed by strcpy(). I see the code you have put up comes from publib.boulder.ibm.com.

That depends on our requirement. For windows users

We use strncpy whenever we don't want to copy entire string or we want to copy only n number of characters. But strcpy copies the entire string including terminating null character.

These links will help you more to know about strcpy and strncpy and where we can use.

about strcpy

about strncpy

the strncpy is a safer version of strcpy as a matter of fact you should never use strcpy because its potential buffer overflow vulnerability which makes you system vulnerable to all sort of attacks

  • 6
    See lysator.liu.se/c/rat/d11.html : The strncpy function strncpy was initially introduced into the C library to deal with fixed-length name fields in structures such as directory entries. Such fields are not used in the same way as strings: the trailing null is unnecessary for a maximum-length field, and setting trailing bytes for shorter names to null assures efficient field-wise comparisons. strncpy is not by origin a ``bounded strcpy,'' and the Committee has preferred to recognize existing practice rather than alter the function to better suit it to such use. – Sinan Ünür Aug 11 '09 at 6:19

protected by Lundin Jul 4 '16 at 11:37

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.