bugTiny C Compiler - Bugs: bug #57038, snprintf implementation buggy

 
 

bug #57038: snprintf implementation buggy

Submitter:  None
Submitted:  Fri 11 Oct 2019 03:55:53 AM UTC
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Mon 30 Mar 2020 10:42:37 PM UTC, comment #1: 

code snippets need markdown for pretty printing.

```c
#include <stdio.h>
#include <string.h>

final code version to try for repro:

int main(int argc, char ** argv)
{
char buf[32];
memset(buf, 0xFF, 32);
snprintf(buf, 16, "%s", "1234567890ABCDEFabcdef");

if (buf[15] == 'F')
{
printf("DANGER!!!\n");
}
else
{
printf("FAILED\n");
}

printf(buf);
}
```

seems okay to me, if snprintf's second argument is 1-indexed and buf elements are 0-indexed.
I can't explain the presence of last character in buf. see output of line 19(the character is invisible in preview )->
```c
1234567890ABCDEF                  
```

or why both #include lines are optional for successful compilation using tcc.

used Windows 10 1909 with tcc-0.9.27

Anonymous
Fri 11 Oct 2019 03:55:53 AM UTC, original submission:  

One of my users found that "Windows 10 w/tcc-0.9.27" snprintf() has a buffer-overrun bug.

Code to repro:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char ** argv)
{
char buf[32];
memset(buf, 0xFF, 32);
snprintf(buf, 16, "%s", "1234567890ABCDEFabcdef");
if (buf[15])
{
if (buf[15] == 'F')
printf("DANGER!!!\n");
else
printf("FAILED\n");
}
else
printf("OK\n");
}

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

 

 

 

No changes have been made to this item

Back to the top


Powered by Savane 3.9