[PATCH 0/2] Split *s*printf(3) from printf(3), and document the snprintf(,-1,) is UB

[Alejandro Colomar <alx@kernel.org>]

Hi!

Serge and I were reviewing some code, and we realized that it seems
quite easy to induce a buffer overflow using snprintf(3).

We solved our problems by checking that the size is non-negative in
a wrapper inline function.

	// vstprintf - va_list string truncate print formatted
	inline int
	vstprintf(char *restrict s, ssize_t size, const char *restrict fmt, va_list ap)
	{
		int  len;

		if (size <= 0 || size > INT_MAX) {
			errno = EOVERFLOW;
			return -1;
		}
		len = vsnprintf(s, size, fmt, ap);
		if (len == -1) {
			if (errno == EOVERFLOW)
				errno = E2BIG;
			return -1;
		}
		if (len >= size) {
			errno = E2BIG;
			return -1;
		}

		return len;
	}

[v]snprintf(3) seems to be even worse than I thought it was.
Let's document this.


Alejandro Colomar (2):
  man/man3/*printf.3: Split *s*printf(3) from printf(3)
  man/man3/snprintf.3: BUGS: snprintf(3) with a negative size is
    essentially UB

 man/man3/printf.3    | 223 +---------------------------
 man/man3/snprintf.3  | 337 ++++++++++++++++++++++++++++++++++++++++++-
 man/man3/sprintf.3   |   2 +-
 man/man3/vsnprintf.3 |   2 +-
 man/man3/vsprintf.3  |   2 +-
 5 files changed, 346 insertions(+), 220 deletions(-)

Range-diff:
-:  --------- > 1:  a654dcfc2 man/man3/*printf.3: Split *s*printf(3) from printf(3)
-:  --------- > 2:  d00ed9434 man/man3/snprintf.3: BUGS: snprintf(3) with a negative size is essentially UB

base-commit: 2a5edb7e59ae024d1969e7379c078a58b5f50b80
-- 
2.51.0