From e118a1f48e9ca314863a8008e51bc1b5e38af862 Mon Sep 17 00:00:00 2001
From: Xavier Roche <roche@httrack.com>
Date: Wed, 21 Oct 2026 18:08:40 +0200
Subject: [PATCH] Copy the rewritten tag with memcpy, which writes no NUL

The tag is overwritten in place with exactly its own length, so the
missing terminator is intended. CodeQL flagged the strncpy (alert 315).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>
---
 src/htsparse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/htsparse.c b/src/htsparse.c
index d3e4074df..29e8ff181 100644
--- a/src/htsparse.c
+++ b/src/htsparse.c
@@ -1845,7 +1845,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                                     strcatbuff(tempo, " ");
                                   // no error?
                                   if (strlen(tempo) == (size_t) (b - html)) {
-                                    strncpy(modify, tempo, strlen(tempo)); // PAS d'octet nul à la fin!
+                                    // overwrites the tag in place, so no NUL
+                                    memcpy(modify, tempo, strlen(tempo));
                                     fetch_tag.name = NULL; /* the tag changed */
                                     p = 0;      // DEVALIDER!!
                                     p_type = 0;