Re: [PATCH 2/4] lib/vsprintf: fix OOB write in vbin_printf() when size is zero

[Petr Mladek]

On Tue 2026-03-24 22:49:38, Josh Law wrote:
> When vbin_printf() is called with size==0, end equals bin_buf and
> the else branch writes end[-1], which is one byte before the buffer.
> 
> Guard the write so it only happens when the buffer is non-empty.
> 
> Signed-off-by: Josh Law <objecting@xxxxxxxxxxxxx>

Great catch!

There is only one in-tree user and it never passes size=0 so there was
no overflow in the reality. But better be on the safe side.

Reviewed-by: Petr Mladek <pmladek@xxxxxxxx>

Best Regards,
Petr