Re: [PATCH 1/4] lib/vsprintf: always advance args in bstr_printf() pointer path

Petr Mladek
2026-03-30T16:06:31Z

On Tue 2026-03-24 22:49:37, Josh Law wrote:
> When the output buffer is full (str >= end), bstr_printf() skips
> advancing the args pointer past the pre-rendered pointer string in
> bin_buf. This causes all subsequent format specifiers to read from
> the wrong position, corrupting the rest of the output.
>
> Always compute the string length and advance args regardless of
> whether there is space to copy into the output buffer.
>
> Signed-off-by: Josh Law <objecting@objecting.org>

It looks correct to me. It is interesting that nobody found it yet.
But I guess that all users of bstr_printf() are using big enough
buffers so that it is hard to hit in practice.

Reviewed-by: Petr Mladek <pmladek@suse.com>

Best Regards,
Petr