[avr-libc-dev] [bug #19280] snprintf(s, 0, fmt, ...) write to foreign memory: s[-1]

[Dmitry Xmelkov]

URL:
  <http://savannah.nongnu.org/bugs/?19280>

                 Summary: snprintf(s,0,fmt,...) write to foreign memory:
s[-1]
                 Project: AVR C Runtime Library
            Submitted by: dmix
            Submitted on: Воскресенье 11.03.2007 at 05:16
                Category: None
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
        Percent Complete: 0%
             Assigned to: None
        Originator Email: address@hidden
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

Size is decremented (to reserve space for trailing zero)
without an underflow control. Comparison below is signed.
And there is a second misprint: the return value of vfprintf()
is used as a number of writed symbols. This is not always: it may return
EOF.

Correction (all 4 functions) is done, will submited after
tests writing.





    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?19280>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/