Re: UB status of snprintf on invalid ptr+size combination?

[Paul Eggert <eggert@cs.ucla.edu>]

On 3/14/23 12:47, Simon Chopin via Libc-alpha wrote:
> When the issue was first discovered[1], I didn't raise the issue because I
> dismissed it as UB, but it reappeared in an unrelated context, and
> colleagues pointed out that the wording in the standard doesn't actually
> say that the `n` argument is the size of the array.

That sounds like a misreading of the C standard. Even though the 
standard often does not explicitly say that a size argument is the size 
of an array, it's obvious from context that this is intended. So Florian 
is correct here that the call with INT_MAX is not portable C code.

For example, it's valid for snprintf to be implemented this way:

   int
   snprintf (char *buf, size_t size, char const *fmt, ...)
   {
      char *buf_limit = buf + size;
      ...
   }

even though this would have undefined behavior if BUF points to a 
character array smaller than SIZE.

glibc snprintf does the equivalent of the above internally, so it's a 
good thing that notcurses has been fixed to not use the INT_MAX trick as 
that trick already did not work in general with glibc and I assume with 
other C libraries (with rare and hard-to-diagnose failures), even aside 
from any fortification business that made the bug more visible.