Re: [PATCH 2/4] lib/vsprintf: fix OOB write in vbin_printf() when size is zero

Steven Rostedt
2026-03-30T16:30:22Z

On Tue, 24 Mar 2026 22:49:38 +0000
Josh Law <objecting@objecting.org> wrote:

> When vbin_printf() is called with size==0, end equals bin_buf and
> the else branch writes end[-1], which is one byte before the buffer.
>
> Guard the write so it only happens when the buffer is non-empty.
>
> Signed-off-by: Josh Law <objecting@objecting.org>
> ---
> lib/vsprintf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 7898fb998b21..72fbfe181076 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -3234,7 +3234,7 @@ int vbin_printf(u32 *bin_buf, size_t size, const char *fmt_str, va_list args)
> spec);
> if (str + 1 < end)
> *str++ = '\0';
> - else
> + else if (end > (char *)bin_buf)
> end[-1] = '\0'; /* Must be nul terminated */

instead of doing a comparison, couldn't we just check size?

else if (size) /* do nothing if size is zero */

I'm guessing this would be slightly more efficient in the assembly.

-- Steve

> }
> /* skip all alphanumeric pointer suffixes */