---
id: "bug-1703"
status: "fixed"
status_updated: "2026-09-28"
status_note: ""
component: "controller"
severity: "unknown"
timestamp: "2026-08-26T09:32:18Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/harness/test.c"]
tags: ["controller", "testsuite", "xce_test", "cmd_jobsub", "buffer-overflow", "memory-safety", "cli-ux-audit"]
related: ["bug-1702"]
fix_commits: ["da1a663f"]
legacy: true
gitea_issue: 300
gitea_synced_status: "fixed"
gitea_synced_hash: "cb775a86ae2d"
---

# bug-1703: cmd_jobsub's `-n <min>,<max>` parsing copies the min-value substring into a fixed 64-byte stack…

## Description
cmd_jobsub's `-n <min>,<max>` parsing copies the min-value substring into a fixed 64-byte stack buffer with an unbounded strncpy (length = bytes before ',' in the user-supplied argument, never clamped to sizeof(buf)). A -n argument with 64+ characters before the comma overflows the stack buffer.

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
Same pattern as bug-1702: `strncpy(buf, optarg, (int)(p - optarg))` with no bound check against sizeof(buf).

## Fix
jobsub's -n now goes through cmdutil_parse_ntasks(), which parses min and max in place (no copy into a buffer) and refuses anything but 1 <= min <= max, with a usage error.

## Verification
- Test: test_jobsub_overlong_ntasks_rejected_without_overflow in src/harness/testsuite/test_test_cli.c: RED before the fix (ASAN stack-buffer-overflow, WRITE of size 100), GREEN after; plus the parse_ntasks cases in src/harness/testsuite/test_cmdutil.c
- Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
- Live: n/a; xce_test is a client tool and every case above runs without a controller

## References
- Related: bug-1702