[RFC PATCH 0/1] lib/vsnprintf: Limit the returning size to INT_MAX

[Masami Hiramatsu (Google)]

Hi,

Recently we discussed snprintf() usage in bootconfig and found snprintf()
design has a problem[1]. It returns the required or printed size in 'int'
but the maxlen is passed by 'size_t'. If the maxlen is bigger than INT_MAX
(this should never happen), it can not return the size correctly, that
becomes negative value or very shorter than it has actually done.

I think it should not be handled by caller side, instead, vsnprintf()
should handle it. This is an extremely unlikely input, and if we need to
address it, I think we should keep the fix to a minimum (in performance
point of view).

Thus I just limited the returning size to INT_MAX. If caller sees the
*printf() returns INT_MAX, it can handle it as an error or use strlen()
to get real printed size (but I don't recommend it.)

IMHO, this input is basically impossible unless done intentionally,
so I think it's a form of over-engineering. Therefore, this is an
RFC patch.

A question is that we should use WARN_ON() when the return size is over
INT_MAX. Currently this just returns INT_MAX (no warning) because this is
a library function, which can be called from anywhere.

[1] https://lore.kernel.org/all/20260317121507.30735331@xxxxxxxxxxxxxxxxxx/

Thank you,

---

Masami Hiramatsu (Google) (1):
      lib/vsprintf: Limit the returning size to INT_MAX


 drivers/firmware/efi/libstub/vsprintf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>