False sense of security with `snprintf_s`

Question

MSVC's "secure" sprintf funcions have a template version that 'knows' the size of the target buffer. However, this code happily paints 567890 over the stack after the end of bytes...

char bytes[5];
_snprintf_s( bytes, _TRUNCATE, "%s", "1234567890" );

Any idea what I do wrong, or is this a known bug?

(I'm working in VS2005 - didn't test in 2008 or 2010)

Answer 1

It does appear to be a bug in Visual C++ 2005 (I'm having trouble getting to that link; Google also has it cached).

I was able to reproduce the problem in Visual C++ 2005. In Visual C++ 2008 and 2010, the string is correctly truncated (bytes contains 1234\0) and -1 is returned as expected.