Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
From:   David Laight <David.Laight@ACULAB.COM>
To:     'Lee Jones' <lee@kernel.org>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "Linus Walleij" <linus.walleij@linaro.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Yuan-Hsin Chen <yhchen@faraday-tech.com>,
        Feng-Hsin Chiang <john453@faraday-tech.com>,
        Po-Yu Chuang <ratbert.chuang@gmail.com>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>
Subject: RE: [PATCH 3/5] usb: fotg210-hcd: Replace snprintf() with the safer
 scnprintf() variant
Thread-Topic: [PATCH 3/5] usb: fotg210-hcd: Replace snprintf() with the safer
 scnprintf() variant
Thread-Index: AQHaI3u56JraFtMggUKBqY7WM/KeMLCS64WA
Date:   Thu, 30 Nov 2023 14:40:12 +0000
Message-ID: <f79f570f12cf424b992a7bc87664588a@AcuMS.aculab.com>
References: <20231130105459.3208986-1-lee@kernel.org>
 <20231130105459.3208986-4-lee@kernel.org>
In-Reply-To: <20231130105459.3208986-4-lee@kernel.org>
Accept-Language: en-GB, en-US
MIME-Version: 1.0
Content-Language: en-US
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Precedence: bulk

From: Lee Jones
> Sent: 30 November 2023 10:55
> 
> There is a general misunderstanding amongst engineers that {v}snprintf()
> returns the length of the data *actually* encoded into the destination
> array.  However, as per the C99 standard {v}snprintf() really returns
> the length of the data that *would have been* written if there were
> enough space for it.  This misunderstanding has led to buffer-overruns
> in the past.  It's generally considered safer to use the {v}scnprintf()
> variants in their place (or even sprintf() in simple cases).  So let's
> do that.
> 
> The uses in this file both seem to assume that data *has been* written!
...
> -		temp = snprintf(next, size,
> -				"\n\t%p%c%s len=%d %08x urb %p",
> -				td, mark, ({ char *tmp;
...
> -		if (size < temp)
> -			temp = size;

That is actually a bug - even though it is trying to be correct.
The trailing '\0' that snprintf() adds (unless you are using the
M$ one) will end up in the buffer.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)