bugAVR C Runtime Library - Bugs: bug #22800, sprintf() expands a 128char string...

 
 

bug #22800: sprintf() expands a 128char string parameter incorrectly

Submitted by:  David Prentice <david_prentice>
Submitted on:  Tue 01 Apr 2008 12:34:21 PM UTC  
 
Category: LibrarySeverity: 3 - Normal
Priority: 5 - NormalItem Group: libc code
Status: InvalidPercent Complete: 100%
Assigned to: Dmitry Xmelkov <dmix>Open/Closed: Closed
Release: NoneFixed Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 01 Apr 2008 11:27:55 PM UTC, comment #2:

I can not to reproduce this bug with Avr-libc 1.6

With Avr-libc 1.4 (old variant of vfprintf()), yes, it is a bug:
documention does not say about any limits of string
length in case of 'width' field absence.

About size of width variable: the documentation says
about the limit of width value, it is 255. Avr-libc 1.4 has
this limit 127. Note, this limit does not restrict the length
in case of 'width' field absence.

I have write the test case and will commit to CVS later.

Dmitry Xmelkov <dmix>
Project AdministratorIn charge of this item.
Tue 01 Apr 2008 08:36:59 PM UTC, comment #1:

Dmitry, can you check this, please?

I think this is a bug somewhere in the following snippet:

case 's':
pnt = va_arg (ap, char *);
size = strnlen (pnt, (flags & FL_PREC) ? prec : ~0);
no_pgmstring:
flags &= ~FL_PGMSTRING;
goto str_lpad;

case 'S':
pnt = va_arg (ap, char *);
size = strnlen_P (pnt, (flags & FL_PREC) ? prec : ~0);
flags |= FL_PGMSTRING;

str_lpad:
if (!(flags & FL_LPAD)) {
while (size < width) {
putc (' ', stream);
width--;
}
}
while (size) {
putc (GETBYTE (flags, FL_PGMSTRING, pnt), stream);
if (width) width -= 1;
size -= 1;
}

My guess is that width has to be declared as uint16_t rather
than unsigned char. What do you think?

Joerg Wunsch <joerg_wunsch>
Project Administrator
Tue 01 Apr 2008 12:34:21 PM UTC, original submission:

In the unlikely event that a very long string parameter is sent to sprintf(), the expanded string is a space padded 256 byte string. A regular (less than 128 bytes long) string behaves normally.

e.g.:

<pre>
#include <avr/io.h>
#include <stdio.h>

char buffer[300], string[200];
char tmp[] ="123";

int main ( void )
{
int i;
// just put some data to the buffer
for (i=0; i<129; i++)
{
string[i] = 'B';
}
// try to add a string to the buffer
sprintf (buffer,"%s%s",string,tmp);

while (1)
{
}
return 1;
}
</pre>

the buffer becomes: " ... BB...BB123"
instead of "BB...BB123"

David Prentice <david_prentice>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by dmix (Posted a comment)
  • -unavailable- added by joerg_wunsch (Posted a comment)
  • -unavailable- added by david_prentice (Submitted the item)
  • -unavailable- added by david_prentice (AVR libc bug)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 01 Apr 2008 11:27:55 PM UTCdmixStatusNone=>Invalid
      Percent Complete0%=>100%
      Open/ClosedOpen=>Closed
    Tue 01 Apr 2008 08:36:59 PM UTCjoerg_wunschAssigned toNone=>dmix
    Tue 01 Apr 2008 12:34:21 PM UTCdavid_prenticeCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1