From: Maciej W. Rozycki > Sent: 16 April 2021 11:49 > > On Thu, 15 Apr 2021, Joe Perches wrote: > > > In patch 2, vscnprintf should probably be used to make sure it's > > 0 terminated. > > Why? C99 has this[1]: > > "The vsnprintf function is equivalent to snprintf, with the variable > argument list replaced by arg, which shall have been initialized by the > va_start macro (and possibly subsequent va_arg calls)." vscnprintf() is normally the function you want (not vsnprintf()) because the return value is the number of characters actually put into the buffer, not the number that would have been written had the buffer been long enough. Return values larger than the buffer size are almost never allowed for - and are probably a set of 'buffer overflow' bugs. While probably justified by saying that it lets you malloc() a big enough buffer and try again, the return value is almost certainly just historic. The original sprintf() libc code allocated a FILE structure on stack set to fully-buffered with the current buffer pointer set to the caller's buffer and a buffer length of MAXINT. It then just called vprintf() to do the work. snprintf() was done the same way, except the buffer length was set and the 'write character' (or 'flush buffer') function intercepted to avoid writes beyond the buffer end. (Possibly by re-routing the writes to a global buffer.) The return value from vprintf() gets returned to the user. The Unix versions have always '\0' terminated the buffer. Only Microsoft has ever released an snprintf() that doesn't '\0' terminate the output - another source of bugs. Personally I think bounded string functions should return the buffer size on overflow. This means sequences of: offset += xxx(buf + offset, sizeof buf - offset, ...); are safe and the overflow can be detected right at the end. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
