RE: [PATCH 1/1] lib/vsprintf: Implement ssprintf() to catch truncated strings

[David Laight]

...
> > I'm sure that the safest return for 'truncated' is the buffer length.
> > The a series of statements like:
> > 	buf += xxx(buf, buf_end - buf, .....);
> > can all be called with a single overflow check at the end.
> >
> > Forget the check, and the length just contains a trailing '\0'
> > which might cause confusion but isn't going to immediately
> > break the world.
> 
> snprintf() does this and has been proven to cause buffer-overflows.
> There have been multiple articles authored describing why using
> snprintf() is not generally a good idea for the masses including the 2
> linked in the commit message:

snprintf() returns the number of bytes that would have been output [1].
I'm not suggesting that, or not terminating the buffer.
Just returning the length including the '\0' (unless length was zero).
This still lets the code check for overflow but isn't going to
generate a pointer outside the buffer if used to update a pointer.

[1] I'm pretty certain this is because the original libc version
of sprintf() allocated a FILE structure on stack (fully buffered)
and called fprintf().
snprintf() would have been done the same way but with something
to stop the buffer being flushed.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)