netdev - RE: [PATCH net-next 4/4] s390/qeth: Convert sprintf/snprintf to scnprintf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63c6825fc2c94ad19ac7de93a6f151f6@AcuMS.aculab.com>
Date:   Wed, 8 Feb 2023 14:37:32 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Simon Horman' <simon.horman@...igine.com>,
        Alexandra Winter <wintera@...ux.ibm.com>
CC:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
        Heiko Carstens <hca@...ux.ibm.com>,
        Thorsten Winkler <twinkler@...ux.ibm.com>,
        Jules Irenge <jbi.octave@...il.com>
Subject: RE: [PATCH net-next 4/4] s390/qeth: Convert sprintf/snprintf to
 scnprintf

From: Simon Horman
> Sent: 07 February 2023 15:43
...
> However, amongst other usages of the return value,
> those callers also check for a return < 0 from this function.
> Can that occur, in the sprintf or scnprintf case?

That rather depends on what happens with calls like:
	snprintf(NULL, 0, "*%s%*s", MAX_INT, "", MAX_INT, "");

That is a whole bag of worms you don't want to put your hand into.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)