From: Lee Jones
> Sent: 30 November 2023 10:55
>
> There is a general misunderstanding amongst engineers that {v}snprintf()
> returns the length of the data *actually* encoded into the destination
> array. However, as per the C99 standard {v}snprintf() really returns
> the length of the data that *would have been* written if there were
> enough space for it. This misunderstanding has led to buffer-overruns
> in the past. It's generally considered safer to use the {v}scnprintf()
> variants in their place (or even sprintf() in simple cases). So let's
> do that.
>
> The uses in this file both seem to assume that data *has been* written!
...
> - temp = snprintf(next, size,
> - "\n\t%p%c%s len=%d %08x urb %p",
> - td, mark, ({ char *tmp;
...
> - if (size < temp)
> - temp = size;
That is actually a bug - even though it is trying to be correct.
The trailing '\0' that snprintf() adds (unless you are using the
M$ one) will end up in the buffer.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
