Commit c2fe55bb authored by Inaky Perez-Gonzalez's avatar Inaky Perez-Gonzalez Committed by Anas Nashif
Browse files

libc/minimal: snprintf(): KILL negative len parameter 



snprintf() implements the ability to foce a negative value through the
(unsigned) size_t len parameter to allow the formatter to use a
maximum size string.

This is point less, we don't have as much memory and this is a recipe
for all kinds of vulnerabilities.

Kill the whole thing, the testcase it represents and thank Coverity
for finding this thing. Whatever use it had before, it has no more.

Change-Id: If422246548664699d8aa328a1b9304ef13cab7ea
Coverity-ID: 131625
Coverity-ID: 131626
Signed-off-by: default avatarInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
parent 70028dd9

lib/libc/minimal/source/stdout/sprintf.c

+4 −12
Original line number Diff line number Diff line
@@ -45,12 +45,8 @@ int snprintf(char *_Restrict s, size_t len, const char *_Restrict format, ...) 
	int     r;

	char    dummy;



	if ((int) len <= 0) {

	if (len == 0) {

			s = &dummy; /* write final NUL to dummy, since can't change *s */

		} else {

		len = 0x7fffffff;  /* allow up to "maxint" characters */

		}

		s = &dummy; /* write final NUL to dummy, can't change *s */

	}



	p.ptr = s;
@@ -88,12 +84,8 @@ int vsnprintf(char *_Restrict s, size_t len, const char *_Restrict format, va_li 
	int     r;

	char    dummy;



	if ((int) len <= 0) {

	if (len == 0) {

			s = &dummy; /* write final NUL to dummy, since can't change *s */

		} else {

			len = 0x7fffffff;  /* allow up to "maxint" characters */

		}

		s = &dummy; /* write final NUL to dummy, can't change * *s */

	}



	p.ptr = s;

tests/kernel/test_sprintf/src/test_sprintf.c

+0 −41
Original line number Diff line number Diff line
@@ -235,27 +235,6 @@ int vsnprintfTest(void) 
	int  status = TC_PASS;

	char buffer[100];



	/*

	 * The string size may be handled in a non-standard manner.

	 * If a negative value is supplied for the string size, it is converted

	 * to 0x7fffffff--maximum integer size.  Since there is insufficient

	 * memory to test a string of that length, we just check that the string

	 * was fully written so that we can exercise the code path.

	 */

	buffer[0] = '\0';

	len = tvsnprintf(buffer, (size_t)(-4), "%x", DEADBEEF);

	if (len != strlen(DEADBEEF_LHEX_STR)) {

		TC_ERROR("vsnprintf(%%x).  Expected return value %d, not %d\n",

				 strlen(DEADBEEF_LHEX_STR), len);

		status = TC_FAIL;

	}



	if (strcmp(buffer, DEADBEEF_LHEX_STR) != 0) {

		TC_ERROR("vsnprintf(%%x).  Expected '%s', got '%s'\n",

				 DEADBEEF_LHEX_STR, buffer);

		status = TC_FAIL;

	}



	/*******************/

	buffer[0] = '\0';

	len = tvsnprintf(buffer, 0, "%x", DEADBEEF);
@@ -356,26 +335,6 @@ int snprintfTest(void) 
	int  status = TC_PASS;

	char buffer[100];



	/*

	 * The string size may be handled in a non-standard manner.

	 * If a negative value is supplied for the string size, it is converted

	 * to 0x7fffffff--maximum integer size.  Since there is insufficient

	 * memory to test a string of that length, we just check that the string

	 * was fully written so that we can exercise the code path.

	 */

	buffer[0] = '\0';

	len = snprintf(buffer, (size_t)(-4), "%x", DEADBEEF);

	if (len != strlen(DEADBEEF_LHEX_STR)) {

		TC_ERROR("snprintf(%%x).  Expected return value %d, not %d\n",

				 strlen(DEADBEEF_LHEX_STR), len);

		status = TC_FAIL;

	}



	if (strcmp(buffer, DEADBEEF_LHEX_STR) != 0) {

		TC_ERROR("snprintf(%%x).  Expected '%s', got '%s'\n",

				 DEADBEEF_LHEX_STR, buffer);

		status = TC_FAIL;

	}



	/*******************/

	buffer[0] = '\0';

CRA Git | Maintained and supported by SUSTech CRA and CCSE