diff options
| author | das <das@FreeBSD.org> | 2012-04-21 06:10:18 +0000 |
|---|---|---|
| committer | das <das@FreeBSD.org> | 2012-04-21 06:10:18 +0000 |
| commit | 510fa4d86938ebd3f58060f9768fb4ed615fb1ca (patch) | |
| tree | 8a8b7032e151e3edb3b1e735fa73e6fc209b6586 /lib/libc/stdio/vsnprintf.c | |
| parent | eac48bba4cc5551ad13c07070a93014c28b6a1cd (diff) | |
| download | FreeBSD-src-510fa4d86938ebd3f58060f9768fb4ed615fb1ca.zip FreeBSD-src-510fa4d86938ebd3f58060f9768fb4ed615fb1ca.tar.gz | |
If the size passed to {,v}s{w,n}printf is larger than INT_MAX+1
(i.e., the return value would overflow), set errno to EOVERFLOW
and return an error. This improves the chances that buggy
applications -- for instance, ones that pass in a negative integer
as the size due to a bogus calculation -- will fail in safe ways.
Returning an error in these situations is specified by POSIX, but
POSIX appears to have an off-by-one error that isn't duplicated in
this change.
Previously, some of these functions would silently cap the size at
INT_MAX+1, and others would exit with an error after writing more
than INT_MAX characters.
PR: 39256
MFC after: 2 weeks
Diffstat (limited to 'lib/libc/stdio/vsnprintf.c')
| -rw-r--r-- | lib/libc/stdio/vsnprintf.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/libc/stdio/vsnprintf.c b/lib/libc/stdio/vsnprintf.c index d2bad0f..82959d1 100644 --- a/lib/libc/stdio/vsnprintf.c +++ b/lib/libc/stdio/vsnprintf.c @@ -41,6 +41,7 @@ static char sccsid[] = "@(#)vsnprintf.c 8.1 (Berkeley) 6/4/93"; #include <sys/cdefs.h> __FBSDID("$FreeBSD$"); +#include <errno.h> #include <limits.h> #include <stdio.h> #include "local.h" @@ -59,8 +60,11 @@ vsnprintf_l(char * __restrict str, size_t n, locale_t locale, on = n; if (n != 0) n--; - if (n > INT_MAX) - n = INT_MAX; + if (n > INT_MAX) { + errno = EOVERFLOW; + *str = '\0'; + return (EOF); + } /* Stdio internals do not deal correctly with zero length buffer */ if (n == 0) { if (on > 0) |
