Skip to content

fix(cutils): handle vsnprintf encoding error in dbuf_printf #1482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
andreasrosdal wants to merge 1 commit into
base: master
Choose a base branch
from
+6 −0
Open

fix(cutils): handle vsnprintf encoding error in dbuf_printf #1482

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cutils.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -846,6 +846,12 @@ static inline int JS_PRINTF_FORMAT_ATTR(2, 3) dbuf_printf(DynBuf *s, JS_PRINTF_F
va_start(ap, fmt);
len = vsnprintf(buf, sizeof(buf), fmt, ap);
va_end(ap);
if (len < 0) {
/* vsnprintf encoding error: don't let the caller wrap s->size by
advancing it by -1, which would underflow to near SIZE_MAX. */
s->error = true;
return -1;
}
Comment on lines +849 to +854
Copy link
Copy Markdown
Contributor

@bnoordhuis bnoordhuis May 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this should just be an assert? I'm trying to think of a scenario where len < 0 could happen that is not a bug on our side, but I can't come up with anything.

Copy link
Copy Markdown
Contributor

@saghul saghul May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, this is not exposed to user code to it must be an internal one, so let's assert on it.

if (len < (int)sizeof(buf)) {
/* fast case */
return dbuf_put(s, (uint8_t *)buf, len);
Expand Down
Loading