[Bug stdio/31251] New: libio: snprintf(str, SIZE_MAX, "Hello world!") does not write the last char

["i at maskray dot me" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31251

            Bug ID: 31251
           Summary: libio: snprintf(str, SIZE_MAX, "Hello world!") does
                    not write the last char
           Product: glibc
           Version: 2.37
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: i at maskray dot me
  Target Milestone: ---

Since about
https://sourceware.org/git/?p=glibc.git;a=commit;h=e88b9f0e5cc50cab57a299dc7efe1a4eb385161d
(stdio-common: Convert vfprintf and related functions to buffers)

```
% cat sn.c
#include <stdio.h>
#include <stdint.h>

int main() {
  char str[20];
  snprintf(str, SIZE_MAX, "Hello world!");
  puts(str);
}
% cc sn.c
% ./a.out
Hello world
```

Call trace:

__vsnprintf_internal 
  __printf_buffer_snprintf_init
    __printf_buffer_init
      __printf_buffer_init_end: `base + len` (write_end) may wrap around if
`len` is too large (e.g. SIZE_MAX)
  __printf_buffer_snprintf_done
    The condition `if (buf->base.write_ptr < buf->base.write_end)` fails.
`buf->base.write_ptr[-1] = '\0' drops the last char.

Notes:

Bounds-checked functions, such as printf_s , fprintf_s, sprintf_s, and
snprintf_s, specify RSIZE_MAX as the upperbound. We don't define RSIZE_MAX.

musl snprintf returns -1 with errno=EOVERFLOW when bufsz > INT_MAX.

% cat sn.c
#include <stdio.h>
#include <limits.h>

int main() {
  char str[20];
  int ret = snprintf(str, INT_MAX, "a!");
  printf("%d %s\n", ret, str);
  ret = snprintf(str, INT_MAX+1L, "a!");
  printf("%d %s\n", ret, str);
}
% ~/musl/out/debug/obj/musl-gcc sn.c -o sn.musl && ./sn.musl
2 a!
-1 a!

-- 
You are receiving this mail because:
You are on the CC list for the bug.