Re: UB status of snprintf on invalid ptr+size combination?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 2023-03-20 09:50, Vincent Lefevre wrote:
> On 2023-03-20 08:05:32 -0400, Siddhesh Poyarekar wrote:
>> I think on the glibc front it makes sense from a security
>> perspective to interpret this through POSIX than the C standard.
>> Even if the C standard is clarified to be contrary to POSIX and
>> explicitly state that n is not the size of the buffer (which would
>> be a terrible mistake IMO), I'd lean towards violating the C
>> standard and conforming to POSIX instead.
> 
> I disagree about the POSIX behavior (assuming it is intentional).

Why do you think it may be unintentional?  The POSIX wording seems 
pretty deliberate and clear to me.  The C standard wording on the other 
hand leaves things to the imagination, which is why we're having this 
discussion.

> With it, if the compiler detects that n is larger than the actual
> buffer size, then due to undefined behavior, the compiler could
> assume that this is dead code and introduce erratic behavior in
> code written with the C standard in mind (or when it was introduced
> in BSD).

In fact, with _FORTIFY_SOURCE, if the runtime detects that n is larger 
than the actual buffer size, the code will abort, see pr28989[1].  But 
that's a runtime feature, nothing to do with gcc.

gcc at the moment doesn't have any such check AFAICT but if it does, I 
reckon that's a discussion to be had on the gcc mailing list.

Sid

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=28989