From 62051f9761f92dc99c8ce0552239ad10e2062168 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sat, 10 Jan 2026 12:16:22 +0100 Subject: [PATCH] vsnprintf_s: Increase Buffer Size by 1 Another fix similar to https://github.com/rurban/safeclib/commit/f59a0c8c1b5cf19cd0ed7f9bfb3a1e85f54113d0 In function 'safec_ntoa_format', inlined from 'safec_ntoa_long' at str/vsnprintf_s.c:331:12: str/vsnprintf_s.c:256:24: error: writing 32 bytes into a region of size 0 [-Werror=stringop-overflow=] 256 | buf[len++] = '0'; | ~~~~~~~~~~~^~~~~ str/vsnprintf_s.c: In function 'safec_ntoa_long': str/vsnprintf_s.c:312:10: note: at offset 32 into destination object 'buf' of size 32 312 | char buf[PRINTF_NTOA_BUFFER_SIZE]; | ^~~ In function 'safec_ntoa_format', inlined from 'safec_ntoa_long' at str/vsnprintf_s.c:331:12: str/vsnprintf_s.c:260:24: error: writing 32 bytes into a region of size 0 [-Werror=stringop-overflow=] 260 | buf[len++] = '0'; | ~~~~~~~~~~~^~~~~ str/vsnprintf_s.c: In function 'safec_ntoa_long': str/vsnprintf_s.c:312:10: note: at offset 32 into destination object 'buf' of size 32 312 | char buf[PRINTF_NTOA_BUFFER_SIZE]; | ^~~ cc1: all warnings being treated as errors Upstream: https://github.com/rurban/safeclib/pull/150 [backported to version 3.7.1] Signed-off-by: Bernd Kuhls --- src/str/vsnprintf_s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/str/vsnprintf_s.c b/src/str/vsnprintf_s.c index 59dbda94..ca838df1 100644 --- a/src/str/vsnprintf_s.c +++ b/src/str/vsnprintf_s.c @@ -296,7 +296,7 @@ static size_t safec_ntoa_long(out_fct_type out, const char *funcname, unsigned long base, unsigned int prec, unsigned int width, unsigned int flags) { - char buf[PRINTF_NTOA_BUFFER_SIZE]; + char buf[PRINTF_NTOA_BUFFER_SIZE + 1]; size_t len = 0U; // no hash for 0 values -- 2.47.3