How to avoid calling fopen() with a buffer that is not null-terminated in C?

Question

Let's look at this example:

static FILE *open_file(const char *file_path)
{
    char buf[80];
    size_t n = snprintf(buf, sizeof (buf), "%s", file_path);
    assert(n < sizeof (buf));
    return fopen(buf, "r");
}

Here, the assert() is off-by-one. From the manpage for snprintf:

"Upon successful return, these functions return the number of characters printed (excluding the null byte used to end output to strings)."

So, if it returns 80, then the string will fill the buffer, and won't be terminated by \0. This will cause a problem because fopen() assumes it is null terminated.

What is the best way to prevent this?

Answer 1

So, if it returns 80, then the string will fill the buffer, and won't be terminated by \0

That is incorrect: the string would be null-terminated no matter what you pass for file_path. Obviously, the string would be cut off at the sizeof(buf)-1.

Note that snprintf could return a number above 80 as well. This would mean that the string you wanted to print was longer than the buffer you have provided.

What is the best way to prevent this?

You are already doing it: the assert is not necessary for preventing unterminated strings. You can use the return value to decide if any truncation has happened, and pass a larger buffer to compensate:

// Figure out the size
size_t n = snprintf(NULL, 0, "%s", file_path);
// Allocate the buffer and print into it
char *tmpBuf = malloc(n+1);
snprintf(tmpBuf, n+1, "%s", file_path);
// Prepare the file to return
FILE *res = fopen(tmpBuf, "r");
// Free the temporary buffer
free(tmpBuf);
return res;