public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char
@ 2024-01-16 23:21 i at maskray dot me
2024-01-16 23:23 ` [Bug stdio/31251] " i at maskray dot me
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: i at maskray dot me @ 2024-01-16 23:21 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31251
Bug ID: 31251
Summary: libio: snprintf(str, SIZE_MAX, "Hello world!") does
not write the last char
Product: glibc
Version: 2.37
Status: NEW
Severity: normal
Priority: P2
Component: stdio
Assignee: unassigned at sourceware dot org
Reporter: i at maskray dot me
Target Milestone: ---
Since about
https://sourceware.org/git/?p=glibc.git;a=commit;h=e88b9f0e5cc50cab57a299dc7efe1a4eb385161d
(stdio-common: Convert vfprintf and related functions to buffers)
```
% cat sn.c
#include <stdio.h>
#include <stdint.h>
int main() {
char str[20];
snprintf(str, SIZE_MAX, "Hello world!");
puts(str);
}
% cc sn.c
% ./a.out
Hello world
```
Call trace:
__vsnprintf_internal
__printf_buffer_snprintf_init
__printf_buffer_init
__printf_buffer_init_end: `base + len` (write_end) may wrap around if
`len` is too large (e.g. SIZE_MAX)
__printf_buffer_snprintf_done
The condition `if (buf->base.write_ptr < buf->base.write_end)` fails.
`buf->base.write_ptr[-1] = '\0' drops the last char.
Notes:
Bounds-checked functions, such as printf_s , fprintf_s, sprintf_s, and
snprintf_s, specify RSIZE_MAX as the upperbound. We don't define RSIZE_MAX.
musl snprintf returns -1 with errno=EOVERFLOW when bufsz > INT_MAX.
% cat sn.c
#include <stdio.h>
#include <limits.h>
int main() {
char str[20];
int ret = snprintf(str, INT_MAX, "a!");
printf("%d %s\n", ret, str);
ret = snprintf(str, INT_MAX+1L, "a!");
printf("%d %s\n", ret, str);
}
% ~/musl/out/debug/obj/musl-gcc sn.c -o sn.musl && ./sn.musl
2 a!
-1 a!
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug stdio/31251] libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char
2024-01-16 23:21 [Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char i at maskray dot me
@ 2024-01-16 23:23 ` i at maskray dot me
2024-01-17 9:32 ` schwab@linux-m68k.org
2024-01-26 1:47 ` gabravier at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: i at maskray dot me @ 2024-01-16 23:23 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31251
--- Comment #1 from Fangrui Song <i at maskray dot me> ---
I noticed this 2.37 behavior difference by debugging a -fsanitize=dataflow test
failure in LLVM: https://github.com/llvm/llvm-project/issues/60678
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug stdio/31251] libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char
2024-01-16 23:21 [Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char i at maskray dot me
2024-01-16 23:23 ` [Bug stdio/31251] " i at maskray dot me
@ 2024-01-17 9:32 ` schwab@linux-m68k.org
2024-01-26 1:47 ` gabravier at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: schwab@linux-m68k.org @ 2024-01-17 9:32 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31251
Andreas Schwab <schwab@linux-m68k.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |DUPLICATE
Status|NEW |RESOLVED
--- Comment #2 from Andreas Schwab <schwab@linux-m68k.org> ---
dup
*** This bug has been marked as a duplicate of bug 30441 ***
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug stdio/31251] libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char
2024-01-16 23:21 [Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char i at maskray dot me
2024-01-16 23:23 ` [Bug stdio/31251] " i at maskray dot me
2024-01-17 9:32 ` schwab@linux-m68k.org
@ 2024-01-26 1:47 ` gabravier at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: gabravier at gmail dot com @ 2024-01-26 1:47 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31251
Gabriel Ravier <gabravier at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gabravier at gmail dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-01-26 1:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-16 23:21 [Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char i at maskray dot me
2024-01-16 23:23 ` [Bug stdio/31251] " i at maskray dot me
2024-01-17 9:32 ` schwab@linux-m68k.org
2024-01-26 1:47 ` gabravier at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).