mbox series

[0/1] lib/vsprintf.c: fix integer overflow in vsprintf

Message ID 20230309021221.306044-1-paul.liu@linaro.org
Headers show
Series lib/vsprintf.c: fix integer overflow in vsprintf | expand

Message

Paul Liu March 9, 2023, 2:12 a.m. UTC 
vsnprintf_internal() adds 'size' to 'buf' and vsprintf() sets 'size'
to 'INT_MAX' which can overflow.  This causes sprintf() to fail when
initializing the environment on 8GB.

Instead of using 'INT_MAX', we use SIZE_MAX - buf, which is the
largest possible string that could fit without overflowing 'size'.

Tom Cherry (1):
  lib/vsprintf.c: fix integer overflow in vsprintf

 lib/vsprintf.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)