bin/60940: atto: snprintf into b_bname passes NAME_MAX, aborts under _FORTIFY_SOURCE

["kilian.feess%posteo.de@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60940
>Category:       bin
>Synopsis:       atto: snprintf into b_bname passes NAME_MAX, aborts under _FORTIFY_SOURCE
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 29 23:25:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD github mirror, commit 7a4ec9b (NetBSD-current (11.99.9), src/usr.bin/atto as of 2026-10-30)
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
When starting atto without args the scratch buffer is named
snprintf(curbp->b_bname, NAME_MAX, "*scratch*");

b_bname is char[STRBUF_S], STRBUF_S is 16 bytes, but NAME_MAX is 255

I built the source on Ubuntu 26.04 which enables _FORTIFY_SOURCE by default. This crashed the program.

Upstream atto uses strncpy(curbp->b_bname, "*scratch*", STRBUF_S) and thus does not have this bug.
>How-To-Repeat:
On a glibc system, build usr.bin/atto with -O2 -D_FORTIFY_SOURCE=2 (or with Ubuntu's default gcc), then run atto with no arguments. It aborts immediately.
>Fix:
diff --git a/usr.bin/atto/main.c b/usr.bin/atto/main.c
--- a/usr.bin/atto/main.c
+++ b/usr.bin/atto/main.c
@@ -76,7 +76,7 @@ int main(int argc, char **argv)
                }
        } else {
                curbp = find_buffer("*scratch*", TRUE);
-               snprintf(curbp->b_bname, NAME_MAX, "*scratch*");
+               snprintf(curbp->b_bname, sizeof(curbp->b_bname), "*scratch*");
        }