Re: UB status of snprintf on invalid ptr+size combination?

[Vincent Lefevre <vincent@vinc17.net>]

On 2023-03-20 17:15:49 +0100, Alejandro Colomar wrote:
> $ cat str.c 
> #include <stdio.h>
> 
> void f(char *dst, char *src)
> {
> 	sprintf(dst, "%s plus some extra stuff", src);
> }
> 
> $ cat main.c 
> void f(char *dst, char *src);
> 
> int main(void)
> {
> 	char *str = "some long string";
> 	char s[20];
> 
> 	f(s, str);
> }
> 
> $ cc -Wall -Wextra *.c -flto -O3 -fanalyzer -D_FORTIFY_SOURCE=1
> $ ./a.out 
> *** buffer overflow detected ***: terminated
> Aborted
> $ cc -Wall -Wextra *.c -flto -O3 -fanalyzer -D_FORTIFY_SOURCE=3
> alx@asus5775:~/tmp/fort$ ./a.out 
> *** buffer overflow detected ***: terminated
> Aborted
> 
> 
> Is this what you're looking for?  I agree that it would be nicer
> if the analyzer could catch this at build time, but it seems it's
> not yet so powerful.

I meant at build time.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)