Debian Bug report logs - #22541
libc6: snprintf incorrect return value

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Giuliano P Procida <gpp10@cam.ac.uk>

To: submit@bugs.debian.org

Subject: libc6: snprintf incorrect return value

Date: Sun, 17 May 1998 18:18:23 +0100

Package: libc6
Version: 2.0.7pre3-1

The function call

  snprintf (<any pointer>, 0, "foo");

should return -1, but instead returns 0. A similar statement applies
to vnsprintf.

I hope this report is of some use.
Giuliano Procida.

-- System Information
Debian Release: 2.0 (frozen)
Kernel Version: Linux hilfy 2.0.34 #1 Wed Apr 22 22:51:55 BST 1998 i586 unknown

Versions of the packages libc6 depends on:
ii  ldso            1.9.8-1        The Linux dynamic linker, library and utilit

Message #10 received at 22541-maintonly@bugs.debian.org (full text, mbox, reply):

From: Giuliano P Procida <gpp10@cam.ac.uk>

To: 22541-maintonly@bugs.debian.org

Subject: More info on snprintf

Date: Sun, 17 May 1998 19:57:44 +0200

#include <stdio.h>
#include <stdarg.h>

int main () {
  char buffer[10];
  int stat;
  int i;
  for (i = -2; i < 6; ++i) {
    stat = snprintf (buffer, i, "foo");
    printf ("i: %d, stat: %d, expected: %d\n", i , stat, i < 4 ? -1 : 3);
  }
  return 0;
}

/* i: -2, stat: 3, expected: -1
   i: -1, stat: 3, expected: -1
   i: 0, stat: 0, expected: -1
   i: 1, stat: 3, expected: -1
   i: 2, stat: -1, expected: -1
   i: 3, stat: -1, expected: -1
   i: 4, stat: 3, expected: 3
   i: 5, stat: 3, expected: 3 */

In general, these cases are broken:

-ve numbers: well, this is arguable
zero: has been special cased in the source for some reason
one: Real Bug(TM)

Unless there is some compelling reason for special casing, I would
suggest replacing the occurance(s) of:

  if (MAXLEN == 0) return 0;

with

  /* we always need 1 byte for the \0
     XXX what about wide characters? */
  if (MAXLEN < 1) return -1;

I hope this helps.

Giuliano Procida.
-- 
mail: gpp10@cam.ac.uk / myxie@debian.org | public PGP key ID: 93898735
home: +44 1223 561237 / 547 Newmarket Road, Cambridge CB5 8PA, UK
work: +44 1223 332127 / Magdalene College, Cambridge CB3 0AG, UK
work: +44 1223 335333 / International Studies, Cambridge CB2 1QY, UK

Message #15 received at 22541@bugs.debian.org (full text, mbox, reply):

From: Giuliano P Procida <gpp10@cam.ac.uk>

To: 22541@bugs.debian.org

Subject: Better info on snprintf bug

Date: Wed, 20 May 1998 22:18:26 +0200

Here is some more! Please ignore previous witterings which indicated
that I had forgotten that size_t is unsigned!

#include <stdio.h>
#include <stdarg.h>
int main () {
  char b[9];
  int stat;
  int  i;
  for (i = 0; i < 5; ++i) {
    stat = snprintf (b, i, "foo");
    printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
  }
  for (i = -1; i < 5; ++i) {
    stat = snprintf (b, i, "foo");
    printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
  }
  return 0;
}

i 0, got 0, exp -1    <- sick
i 1, got -1, exp -1   <- works OK
i 2, got -1, exp -1
i 3, got -1, exp -1
i 4, got 3, exp 3
i 4294967295, got 3, exp 3 <- throw in MAX_UINT
i 0, got 0, exp -1    <- sick
i 1, got 3, exp -1    <- BROKEN this time
i 2, got -1, exp -1
i 3, got -1, exp -1
i 4, got 3, exp 3

I also tried "fo" and got a different result. Two different computers,
same compiler and library.

Giuliano Procida.

Message #20 received at 22541@bugs.debian.org (full text, mbox, reply):

From: Kevin Ryde <user42@zip.com.au>

To: 22541@bugs.debian.org

Cc: Giuliano P Procida <gpp10@cam.ac.uk>

Subject: Re: Bug#22541: Better info on snprintf bug

Date: 16 Jan 2000 08:03:12 +1000

Giuliano P Procida <gpp10@cam.ac.uk> writes:
>
> Here is some more! Please ignore previous witterings which indicated
> that I had forgotten that size_t is unsigned!
> 
> #include <stdio.h>
> #include <stdarg.h>
> int main () {
>   char b[9];
>   int stat;
>   int  i;
>   for (i = 0; i < 5; ++i) {
>     stat = snprintf (b, i, "foo");
>     printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
>   }
>   for (i = -1; i < 5; ++i) {
>     stat = snprintf (b, i, "foo");
>     printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
>   }
>   return 0;
> }
> 
> i 0, got 0, exp -1    <- sick
> i 1, got -1, exp -1   <- works OK
> i 2, got -1, exp -1
> i 3, got -1, exp -1
> i 4, got 3, exp 3
> i 4294967295, got 3, exp 3 <- throw in MAX_UINT
> i 0, got 0, exp -1    <- sick
> i 1, got 3, exp -1    <- BROKEN this time
> i 2, got -1, exp -1
> i 3, got -1, exp -1
> i 4, got 3, exp 3


I just gave snprintf() a try in libc6 2.1.2-11 and it now returns 3 in
all the above cases, which is correct per the change to ISO C9x
described in the info docs for snprintf(), so I think this bug could
be closed.

Message #25 received at 22541-done@bugs.debian.org (full text, mbox, reply):

From: Joel Klecker <jk@espy.org>

To: Kevin Ryde <user42@zip.com.au>, 22541-done@bugs.debian.org

Cc: Giuliano P Procida <gpp10@cam.ac.uk>

Subject: Re: Bug#22541: Better info on snprintf bug

Date: Wed, 19 Apr 2000 11:08:23 -0700

At 08:03 +1000 2000-01-16, Kevin Ryde wrote:
>Giuliano P Procida <gpp10@cam.ac.uk> writes:
>>
>> Here is some more! Please ignore previous witterings which indicated
>> that I had forgotten that size_t is unsigned!
>>
>> #include <stdio.h>
>> #include <stdarg.h>
>> int main () {
>>   char b[9];
>>   int stat;
>>   int  i;
>>   for (i = 0; i < 5; ++i) {
>>     stat = snprintf (b, i, "foo");
>>     printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
>>   }
>>   for (i = -1; i < 5; ++i) {
>>     stat = snprintf (b, i, "foo");
>>     printf ("i %u, got %d, exp %d\n", i, stat, (size_t) i < 4 ? -1 : 3);
>>   }
>>   return 0;
>> }
>>
>> i 0, got 0, exp -1    <- sick
>> i 1, got -1, exp -1   <- works OK
>> i 2, got -1, exp -1
>> i 3, got -1, exp -1
>> i 4, got 3, exp 3
>> i 4294967295, got 3, exp 3 <- throw in MAX_UINT
>> i 0, got 0, exp -1    <- sick
>> i 1, got 3, exp -1    <- BROKEN this time
>> i 2, got -1, exp -1
>> i 3, got -1, exp -1
>> i 4, got 3, exp 3
>
>
>I just gave snprintf() a try in libc6 2.1.2-11 and it now returns 3 in
>all the above cases, which is correct per the change to ISO C9x
>described in the info docs for snprintf(), so I think this bug could
>be closed.

Thanks for noticing this, I will do so.
-- 
Joel Klecker (aka Espy)       <URL:mailto:espy@debian.org>
Debian Package Maintainer for the GNU C Library.

Send a report that this bug log contains spam.