printf.3: Add a note about sprintf(s, "%s", s)

PATCH In review Petr Baudis 2 participants 4 messages Dec 7, 2008 – Dec 19, 2008 3 messages not in the archive Man-pages: manual pages for Linux -- Sections 2, 3, 4, 5, and 7

lore

Share & tools

lore

Petr Baudis

author

2008-12-07 23:37 UTC #0 lore raw

PATCH 1/1 printf.3: Add a note about sprintf(s, "%s", s)

The result of this operation is undefined as specified in C99, see

	http://sourceware.org/bugzilla/show_bug.cgi?id=7075

Signed-off-by Petr Baudis <[email protected]>

man3/printf.3 +3 -0

index b2ed86a..f8377a7 100644
@@ -750,6 +750,9 @@ or
 The array must contain a terminating null wide character, unless a
 precision is given and it is so small that the number of bytes written
 exceeds it before the end of the array is reached.
+
+If the source array and the target buffer of the function overlap,
+results are undefined.
 .TP
 .B C
 (Not in C99, but in SUSv2.)

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): [email protected]

I agree that there's a problem with the page, but I don't think this patch is sufficient, nor does is it made in quite the right place. (This isn't a point that relates specifically to "%s", but rather to the *s*printf() functions.)

I made a much bigger change that goes into more detail. The patch, destined for 3.16, is shown below. Does it look okay to you?

Cheers,

Michael

man3/printf.3 +0 -0

@@ -133,6 +133,17 @@ string that specifies how subsequent arguments

(or arguments accessed via
the variable-length argument facilities of
.BR stdarg (3))
are converted for output.
+
+C99 and POSIX.1-2001 specify that the results are undefined if a call to +.BR sprintf (),
+.BR snprintf (),
+.BR vsprintf (),
+or
+.BR vsnprintf ()
+would cause to copying to take place between objects that overlap +(e.g., if the target string array and one of the supplied input arguments +refer to the same buffer).
+See NOTES.
.SS "Return value"
Upon successful return, these functions return the number of characters printed (not including the
@@ -851,6 +862,26 @@ and conversion characters \fBa\fP and \fBA\fP.
glibc 2.2 adds the conversion character \fBF\fP with C99 semantics, and the flag character \fBI\fP.
.SH NOTES
+Some programs imprudently rely on code such as the following +
+ sprintf(buf, "%s some further text", buf);
+
+to append text to
+.IR buf .
+However, the standards explicitly note that the results are undefined +if source and destination buffers overlap when calling
+.BR sprintf (),
+.BR snprintf (),
+.BR vsprintf (),
+and
+.BR vsnprintf ().
+.\" http://sourceware.org/bugzilla/show_bug.cgi?id=7075
+Depending on the version of
+.BR gcc (1)
+used, and the compiler options employed, calls such as the above will +.B not
+produce the expected results.
+
The glibc implementation of the functions
.BR snprintf ()
and
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): cfd18e0f0812190857k187ca48ct9ee6da3b0c5a9e06-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org

Petr Baudis

author

2008-12-19 17:37 UTC #4 lore raw

Hi,

Quoted 7 lines · Michael Kerrisk

I agree that there's a problem with the page, but I don't think this patch is sufficient, nor does is it made in quite the right place. (This isn't a point that relates specifically to "%s", but rather to the *s*printf() functions.)
I made a much bigger change that goes into more detail. The patch, destined for 3.16, is shown below. Does it look okay to you?

I agree that it is better. Just out of curiosity, can you think of any
other conversions than %s that would cause this? Maybe I missed something obvious but I could not think of anything.

Signature · 7 lines

				Petr "Pasky" Baudis
The average, healthy, well-adjusted adult gets up at seven-thirty
in the morning feeling just terrible. -- Jean Kerr
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): [email protected]

Michael Kerrisk

2008-12-19 18:38 UTC #6 lore raw

Quoted 8 lines · Petr Baudis

Hi,
Quoted 5 lines · Michael Kerrisk
I agree that there's a problem with the page, but I don't think this patch is sufficient, nor does is it made in quite the right place. (This isn't a point that relates specifically to "%s", but rather to the *s*printf() functions.)

Quoted 6 lines

Quoted 2 lines
I made a much bigger change that goes into more detail. The patch, destined for 3.16, is shown below. Does it look okay to you?
I agree that it is better. Just out of curiosity, can you think of any
other conversions than %s that would cause this? Maybe I missed something obvious but I could not think of anything.

Offhand, %s is the only obvious one. But, hey, someone could try weird trickery with other pointers (e.g., interpret some part of the destination buffer as a pointer to int), so I imagine that is why we have the looser wording in the standards.

Cheers,

Michael

Quoted 5 lines

--
Petr "Pasky" Baudis
The average, healthy, well-adjusted adult gets up at seven-thirty in the morning feeling just terrible. -- Jean Kerr

Signature · 9 lines

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html
Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html