In message <http://marc.info/?l=openbsd-tech&m=121183803128128&w=1>,
"Ted Unangst" <ted.unangst () gmail ! com> pointed out that
# strlcpy is wrong with overlapping arguments.

Should this be mentioned in the strlcpy/strlcat man page?
(It isn't as of 4.3-release.)  Here's a suggested patch:

Index: strlcpy.3
===================================================================
RCS file: /cvs/src/lib/libc/string/strlcpy.3,v
retrieving revision 1.19
diff -u -r1.19 strlcpy.3
--- strlcpy.3	31 May 2007 19:19:32 -0000	1.19
+++ strlcpy.3	27 May 2008 10:51:45 -0000
@@ -88,6 +88,17 @@
 It will append at most
 .Fa size
 - strlen(dst) - 1 bytes, NUL-terminating the result.
+.Pp
+.Fa src
+and
+.Fa dst
+must not overlap, i.e., no character copied by
+.Fn strlcpy
+or
+.Fn strlcat
+may be within the initial
+.Fa dst
+string.
 .Sh RETURN VALUES
 The
 .Fn strlcpy

ciao,

-- 
-- Jonathan Thornburg (remove -animal to reply) <J.Thornburg@soton.ac-zebra.uk>
   School of Mathematics, U of Southampton, England
   "Washing one's hands of the conflict between the powerful and the
    powerless means to side with the powerful, not to be neutral."
                                      -- quote by Freire / poster by Oxfam