---
id: "bug-1702"
status: "open"
status_updated: "2026-09-24"
status_note: "xce_test jobrun -m host strncpy into 256B stack buffer unbounded (src/harness/test.c)"
component: "controller"
severity: "unknown"
timestamp: "2026-08-26T09:32:18Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/controller/testsuite/test.c:2130-2136 (cmd_jobrun)"]
tags: ["controller", "testsuite", "xce_test", "cmd_jobrun", "buffer-overflow", "memory-safety", "cli-ux-audit"]
related: ["bug-1703"]
legacy: true
---

# bug-1702: cmd_jobrun's `-m <host>:<ntasks>` parsing copies the host-name substring into a fixed 256-byte…

## Description
cmd_jobrun's `-m <host>:<ntasks>` parsing copies the host-name substring into a fixed 256-byte stack buffer with an unbounded strncpy (length = bytes before ':' in the user-supplied argument, never clamped to sizeof(buf)). A -m argument with a hostname longer than 256 bytes before the ':' overflows the stack buffer.

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
`strncpy(buf, optarg, (int)(p - optarg))` uses the attacker/user-controlled substring length directly with no `MIN(..., sizeof(buf)-1)` clamp, unlike sibling code elsewhere in the file that does bound similar copies.

## Fix
NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject a host-name segment longer than the buffer with a usage error) before strncpy.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Related: bug-1703