[Bug stdio/28989] New: __snprintf_chk bounds check is too strict

["siddhesh at sourceware dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28989

            Bug ID: 28989
           Summary: __snprintf_chk bounds check is too strict
           Product: glibc
           Version: 2.35
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: siddhesh at sourceware dot org
  Target Milestone: ---

__snprintf_chk aborts if the object size is less than the provide length
argument in snprintf.  While this enforces the POSIX requirement of the length
argument being the object size, there's a counter-argument that it's overridden
by the C standard's lack of such a requirement.

We could resolve this by having __vsnprintf_internal accept slen too and call
__chk_fail only if an actual overflow happens but it makes __vsnprintf_internal
more expensive in the general case too.

from the gcc bug:

$ cat sratom.c
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

int size = 3;
unsigned char data = 0xff;

int main()
{
    unsigned len = size * 2 + 1;
    char * str = __builtin_calloc(len, 1);

    for (uint32_t i = 0; i < size; ++i) {
      fprintf (stderr, "i=%i\n", i);
      snprintf((char*)str + (2 * i), len, "%02X", data);
    }

    fprintf (stderr, "R=%s\n", str);
}

$ gcc sratom.c -O2 -D_FORTIFY_SOURCE=3 && ./a.out
i=0
i=1
*** buffer overflow detected ***: terminated
Aborted (core dumped)

$ clang sratom.c -O2 -D_FORTIFY_SOURCE=3 && ./a.out
i=0
i=1
*** buffer overflow detected ***: terminated
Aborted (core dumped)

$ gcc-11 sratom.c -g -O2 -fsanitize=address,undefined && ./a.out 
i=0
i=1
i=2
R=FFFFFF

-- 
You are receiving this mail because:
You are on the CC list for the bug.