Re: UB status of snprintf on invalid ptr+size combination?

[Vincent Lefevre <vincent@vinc17.net>]

On 2023-03-20 08:05:32 -0400, Siddhesh Poyarekar wrote:
> I think on the glibc front it makes sense from a security
> perspective to interpret this through POSIX than the C standard.
> Even if the C standard is clarified to be contrary to POSIX and
> explicitly state that n is not the size of the buffer (which would
> be a terrible mistake IMO), I'd lean towards violating the C
> standard and conforming to POSIX instead.

I disagree about the POSIX behavior (assuming it is intentional).
With it, if the compiler detects that n is larger than the actual
buffer size, then due to undefined behavior, the compiler could
assume that this is dead code and introduce erratic behavior in
code written with the C standard in mind (or when it was introduced
in BSD).

Note that the printf(3) man page from FreeBSD 1.0 (1991), just says:

  Snprintf() and vsnprintf() will write at most size-1 of the
  characters printed into the output string (the size'th character
  then gets the terminating `\0'); if the return value is greater
  than or equal to the size argument, the string was too short and
  some of the printed characters were discarded.

Reference:
https://man.freebsd.org/cgi/man.cgi?query=snprintf&apropos=0&sektion=0&manpath=FreeBSD+1.0-RELEASE&arch=default&format=html

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)