strftime() possible security/crash risk

[Steven Abner]

Hi, me again.

   Still testing against your code, currently flag and bounds testing, and came

across a possible risk?.

Here's how to duplicate:

char buf2[64];

//use your struct and localtime to generate valid ltm

ret = strftime(buf2, 64, "%21V%21w%21G+", &ltm);

printf("%s\n", buf2);

The buf2 is not terminated allowing access to data beyond the buf2.

This was a test so I didn't set up for if (ret != 0) printf(), got a screenful!

It is even possible its a port issue?

Not sure if you find this worthy of even reporting, but silly me!

Steve