Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   David Laight <David.Laight@ACULAB.COM>
To:     "'Maciej W. Rozycki'" <macro@orcam.me.uk>,
        Joe Perches <joe@perches.com>
CC:     Khalid Aziz <khalid@gonehiking.org>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        Christoph Hellwig <hch@lst.de>,
        "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: RE: [PATCH 1/5] scsi: BusLogic: Fix missing `pr_cont' use
Thread-Topic: [PATCH 1/5] scsi: BusLogic: Fix missing `pr_cont' use
Thread-Index: AQHXMq4Y+WsIhBBiNEu36L38d+a4baq4klBA
Date:   Sat, 17 Apr 2021 11:39:28 +0000
Message-ID: <6679310a77984cc0af9f48f5616b840c@AcuMS.aculab.com>
References: <alpine.DEB.2.21.2104141244520.44318@angie.orcam.me.uk>
  <alpine.DEB.2.21.2104141419040.44318@angie.orcam.me.uk>
 <787aae5540612555a8bf92de2083c8fa74e52ce9.camel@perches.com>
 <alpine.DEB.2.21.2104161224300.44318@angie.orcam.me.uk>
In-Reply-To: <alpine.DEB.2.21.2104161224300.44318@angie.orcam.me.uk>
Accept-Language: en-GB, en-US
MIME-Version: 1.0
Content-Language: en-US
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Precedence: bulk

From: Maciej W. Rozycki
> Sent: 16 April 2021 11:49
> 
> On Thu, 15 Apr 2021, Joe Perches wrote:
> 
> > In patch 2, vscnprintf should probably be used to make sure it's
> > 0 terminated.
> 
>  Why?  C99 has this[1]:
> 
> "The vsnprintf function is equivalent to snprintf, with the variable
> argument list replaced by arg, which shall have been initialized by the
> va_start macro (and possibly subsequent va_arg calls)."

vscnprintf() is normally the function you want (not vsnprintf())
because the return value is the number of characters actually
put into the buffer, not the number that would have been written
had the buffer been long enough.
Return values larger than the buffer size are almost never
allowed for - and are probably a set of 'buffer overflow' bugs.

While probably justified by saying that it lets you malloc()
a big enough buffer and try again, the return value is almost
certainly just historic.

The original sprintf() libc code allocated a FILE structure on
stack set to fully-buffered with the current buffer pointer set
to the caller's buffer and a buffer length of MAXINT.
It then just called vprintf() to do the work.

snprintf() was done the same way, except the buffer length was
set and the 'write character' (or 'flush buffer') function
intercepted to avoid writes beyond the buffer end.
(Possibly by re-routing the writes to a global buffer.)
The return value from vprintf() gets returned to the user.

The Unix versions have always '\0' terminated the buffer.
Only Microsoft has ever released an snprintf() that doesn't
'\0' terminate the output - another source of bugs.

Personally I think bounded string functions should
return the buffer size on overflow.
This means sequences of:
	offset += xxx(buf + offset, sizeof buf - offset, ...);
are safe and the overflow can be detected right at the end.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)