Re: [PATCH 2/4] lib/vsprintf: fix OOB write in vbin_printf() when size is zero

Petr Mladek
2026-03-30T16:17:10Z

On Tue 2026-03-24 22:49:38, Josh Law wrote:
> When vbin_printf() is called with size==0, end equals bin_buf and
> the else branch writes end[-1], which is one byte before the buffer.
>
> Guard the write so it only happens when the buffer is non-empty.
>
> Signed-off-by: Josh Law <objecting@objecting.org>

Great catch!

There is only one in-tree user and it never passes size=0 so there was
no overflow in the reality. But better be on the safe side.

Reviewed-by: Petr Mladek <pmladek@suse.com>

Best Regards,
Petr