#include <stdio.h>
#include <string.h>
 
int main()
{
    char a[3], b[4];
 
    // a will have a lower address in memory than b
    printf("%p %p\n", a, b);
 
    // "abc" is a null terminated literal use a size of 4 to force a copy of null
    strncpy(a,"abc",4);
    // printf will not overrun buffer since we terminated it
    printf("a2 = %s\n", a);
 
    // explicitly only copy 3 bytes
    strncpy(b,a,3);
    // manually null terminate b
    b[3] = '\0' ;
 
    // So we can prove we are seeing b's contents
    b[0] = 'z' ;
 
    // This will overrun into b now since b[0] is no longer null
    printf("a2 = %s\n", a);
    printf("b = %s\n", b);
 
}

I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdHJpbmcuaD4KCmludCBtYWluKCkKewogICAgY2hhciBhWzNdLCBiWzRdOwogICAgCiAgICAvLyBhIHdpbGwgaGF2ZSBhIGxvd2VyIGFkZHJlc3MgaW4gbWVtb3J5IHRoYW4gYgogICAgcHJpbnRmKCIlcCAlcFxuIiwgYSwgYik7CiAgICAKICAgIC8vICJhYmMiIGlzIGEgbnVsbCB0ZXJtaW5hdGVkIGxpdGVyYWwgdXNlIGEgc2l6ZSBvZiA0IHRvIGZvcmNlIGEgY29weSBvZiBudWxsCiAgICBzdHJuY3B5KGEsImFiYyIsNCk7CiAgICAvLyBwcmludGYgd2lsbCBub3Qgb3ZlcnJ1biBidWZmZXIgc2luY2Ugd2UgdGVybWluYXRlZCBpdAogICAgcHJpbnRmKCJhMiA9ICVzXG4iLCBhKTsKICAgIAogICAgLy8gZXhwbGljaXRseSBvbmx5IGNvcHkgMyBieXRlcwogICAgc3RybmNweShiLGEsMyk7CiAgICAvLyBtYW51YWxseSBudWxsIHRlcm1pbmF0ZSBiCiAgICBiWzNdID0gJ1wwJyA7CiAgICAKICAgIC8vIFNvIHdlIGNhbiBwcm92ZSB3ZSBhcmUgc2VlaW5nIGIncyBjb250ZW50cwogICAgYlswXSA9ICd6JyA7CiAgICAKICAgIC8vIFRoaXMgd2lsbCBvdmVycnVuIGludG8gYiBub3cgc2luY2UgYlswXSBpcyBubyBsb25nZXIgbnVsbAogICAgcHJpbnRmKCJhMiA9ICVzXG4iLCBhKTsKICAgIHByaW50ZigiYiA9ICVzXG4iLCBiKTsKICAgIAp9