Re: UB status of snprintf on invalid ptr+size combination?

[Vincent Lefevre <vincent@vinc17.net>]

On 2023-03-20 13:17:11 +0100, Alejandro Colomar wrote:
> On 3/20/23 13:05, Siddhesh Poyarekar wrote:
> > On 2023-03-19 19:07, Vincent Lefevre wrote:
> >> The function may not know the buffer size if `checked` is true,
> >> so that it uses a known bound. Thanks to common code factorized,
> >> this is more readable than
> >>
> >>    if (checked)
> >>      sprintf (buf, "%s", s);
> >>    else
> >>      snprintf(buf, n, "%s", s);
> >>
> >> in particular in the cases where the format string is complex.
> 
> That pattern looks like _FORTIFY_SOURCE, doesn't it?  If so, the correct
> action would be to call sprintf(3) and rely on the compiler to do the
> checks.

Not necessarily. Here, this is the programmer who would do the check,
though he may add code (e.g. assertions) on the caller side to give
enough information to the compiler so that a smart compiler could
prove that the call is valid. But this may need an analysis across
different compilation units. If the compiler cannot check, the
validity relies on the proof of the code; but not that in any case,
the code needs to be proved: for instance, snprintf() may yield
data loss and potential security issues if string truncation is
not expected (or if the string is truncation too early).

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)