Messages in this thread | ![/](/images/icornerl.gif) | | Date | Wed, 31 Jan 2024 08:36:42 +0000 | From | Lee Jones <> | Subject | Re: [PATCH 1/1] lib/vsprintf: Implement ssprintf() to catch truncated strings |
| |
On Tue, 30 Jan 2024, Kees Cook wrote:
> On Tue, Jan 30, 2024 at 04:18:42PM +0100, Rasmus Villemoes wrote: > > So here scnprint() would have returned 1, leaving size at 1. scnprintf() > > has the invariant that, for non-zero size, the return value is strictly > > less than that size, so when passed a size of 1, all subsequent calls > > return 0 (corresponding to the fact that all it could do was to write > > the '\0' terminator). > > > > This pattern already exists, and is really the reason scnprint exists. > > Yes, scnprintf() cannot distinguish overflow from > > it-just-exactly-fitted. Maybe it would have been better to make it work > > like this, but I don't think there's a real use - and we do have > > seq_buf() if one really wants an interface that can build a string > > piece-meal while keeping track of whether it ever caused overflow. > > Yeah, I think we can take the handful of places that really need to know > about the overflow and can't reliably use scnprintf() and migrate them > to the seq_buf API. It should be much easier to use now[1] too. > > That way we won't add a new string API, and we can continue to remove > snprintf.
This looks promising. I'll have a look and get back to you.
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/seq_buf.h?id=dcc4e5728eeaeda84878ca0018758cff1abfca21 > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/seq_buf.h?id=7a8e9cdf9405819105ae7405cd91e482bf574b01
-- Lee Jones [李琼斯]
| ![\](/images/icornerr.gif) |