---
id: "bug-1703"
status: "open"
status_updated: "2026-09-24"
status_note: "xce_test jobsub -n min strncpy into 64B stack buffer unbounded (src/harness/test.c)"
component: "controller"
severity: "unknown"
timestamp: "2026-08-26T09:32:18Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/controller/testsuite/test.c:2246-2254 (cmd_jobsub)"]
tags: ["controller", "testsuite", "xce_test", "cmd_jobsub", "buffer-overflow", "memory-safety", "cli-ux-audit"]
related: ["bug-1702"]
legacy: true
---

# bug-1703: cmd_jobsub's `-n <min>,<max>` parsing copies the min-value substring into a fixed 64-byte stack…

## Description
cmd_jobsub's `-n <min>,<max>` parsing copies the min-value substring into a fixed 64-byte stack buffer with an unbounded strncpy (length = bytes before ',' in the user-supplied argument, never clamped to sizeof(buf)). A -n argument with 64+ characters before the comma overflows the stack buffer.

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
Same pattern as bug-1702: `strncpy(buf, optarg, (int)(p - optarg))` with no bound check against sizeof(buf).

## Fix
NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject) before strncpy, same fix shape as bug-1702.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Related: bug-1702