title: fmemopen gives a Valgrind error
body: <p>I have the following code:</p>
  
  <pre><code>char *filedata;
  FILE *f;
  filedata = malloc(3);
  if (filedata == NULL)
  {
      fprintf(stderr, "out of memory\n");
      exit(1);
  }
  memcpy(filedata, "foo", 3);
  f = fmemopen(filedata, 3, "r");
  if (f == NULL)
  {
      fprintf(stderr, "out of memory\n");
      exit(1);
  }
  fclose(f);
  free(filedata);
  </code></pre>
  
  <p>Now, when I execute this with Valgrind, I get the following error:</p>
  
  <pre><code>==32454== Invalid read of size 1
  ==32454==    at 0x4006D33: __GI_strlen (mc_replace_strmem.c:284)
  ==32454==    by 0x855B7E: fmemopen (fmemopen.c:246)
  ==32454==    by 0x80485BF: main (in /home/tilli/memopen/a.out)
  ==32454==  Address 0x402502b is 0 bytes after a block of size 3 alloc'd
  ==32454==    at 0x4005BDC: malloc (vg_replace_malloc.c:195)
  ==32454==    by 0x8048548: main (in /home/tilli/memopen/a.out)
  </code></pre>
  
  <p>It seems like <code>fmemopen</code> is doing an <code>strlen()</code> for the argument I passed to it. However, the manual page says that the buffer argument to <code>fmemopen</code> can be a string or a memory buffer (so it doesn't have to be <code>'\0'</code>-terminated). Furthermore, it says that the argument must be at least <code>size</code> bytes long, which it is.</p>
  
  <p>What is wrong here? Have I just a found a bug in the library function <code>fmemopen</code>? Am I correct that in extreme cases this bug could crash a program using <code>fmemopen</code> if the <code>strlen</code> doesn't find a <code>'\0'</code> terminator but instead continues to read unmapped memory?</p>
  
  <p>I'm running Fedora release 12.</p>