Address case of strncat

Author: jeongsoolee09

cpp/common/src/codingstandards/cpp/OutOfBounds.qll

@@ -379,8 +379,16 @@ module OOB {
     StrncatLibraryFunction() { this.getName() = getNameOrInternalName(["strncat", "wcsncat"]) }
 
     override predicate getALengthParameterIndex(int i) {
-      // `strncat` and `wcsncat` exclude the size of a null terminator
-      i = 2
+      // `strncat` and `wcsncat` exclude the size of a null terminator, but
+      // both stops copying right after the null terminator is encountered.
+      // In fact, they don't care if the source buffer is null-terminated
+      // or not.
+      none()
+    }
+
+    override predicate getANullTerminatedParameterIndex(int i) {
+      // `strncat` does not require null-terminated parameters
+      none()
     }
   }
 

cpp/misra/test/rules/RULE-8-7-1/test.cpp

@@ -411,14 +411,15 @@ void test_wrong_buf_size(void) {
 
   // strncat
   {
-    char buf[64];
-    char buf2[64];
-    strncat(buf, buf2, sizeof(buf));         // COMPLIANT
-    strncat(buf, buf2, sizeof(buf) + 1);     // NON_COMPLIANT
-    strncat(buf, buf2, sizeof(buf) - 1);     // COMPLIANT
-    strncat(buf + 1, buf2, sizeof(buf));     // NON_COMPLIANT
-    strncat(buf, buf2 + 1, sizeof(buf) * 2); // NON_COMPLIANT
+    char buf[65];
+    char buf2[32];
+    strncat(buf, buf2, sizeof(buf2));         // COMPLIANT
+    strncat(buf, buf2, sizeof(buf2) + 1);     // NON_COMPLIANT
+    strncat(buf, buf2, sizeof(buf2) - 1);     // COMPLIANT
+    strncat(buf + 1, buf2, sizeof(buf2));     // COMPLIANT
+    strncat(buf, buf2 + 1, sizeof(buf2) * 2); // NON_COMPLIANT
   }
+
   // wcsxfrm
   {
     wchar_t wbuf[64];