[PATCH 0/4] lib/vsprintf: assorted bug fixes

Josh Law
2026-03-24T22:50:15Z

Four small fixes found during an audit of lib/vsprintf.c:

1. bstr_printf() fails to advance the args pointer past a
pre-rendered pointer string when the output buffer is full,
corrupting all subsequent output.

2. vbin_printf() writes end[-1] unconditionally when NUL-terminating
a pointer string, which is an OOB write when size is zero.

3. vsscanf() uses s16 for field_width but assigns from skip_atoi()
which returns int, silently truncating large widths to negative
and aborting parsing.

4. format_decode() is missing a (u8) cast on the second lookup into
the format_state table, allowing a negative array index on
signed-char platforms.

Josh Law (4):
lib/vsprintf: always advance args in bstr_printf() pointer path
lib/vsprintf: fix OOB write in vbin_printf() when size is zero
lib/vsprintf: use int for field_width in vsscanf()
lib/vsprintf: add missing (u8) cast in format_decode() lookup

lib/vsprintf.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

--
2.34.1