Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 17 Sep 2016 01:17:40 -0400
From: Rich Felker <>
Cc: Alexander Cherepanov <>
Subject: [PATCH] [RFC] fix integer overflows and uncaught EOVERFLOW in printf

This patch expands on issues raised by Alexander Cherepanov earlier
this year with some concrete fixes. I'm not terribly concerned about
what happens when the format string itself contains out-of-range
numbers (although it would be nice to handle that right), but it is
important to handle correctly cases where the data being printed (e.g.
long strings) would cause the total length to overflow INT_MAX, or
where it would cause internal overflows.

This patch:

1. Returns with an error as soon as EOVERFLOW conditions are detected,
   rather than continuing to produce output.

2. Catches overflows where the format string itself is longer than
   INT_MAX (only possible on 64-bit archs).

3. Catches %s argument strings longer than INT_MAX (likewise).

4. Catches cases where adding a prefix length to a precision would

5. Correctly handles width specifiers that overflow (always an error)
   and precision specifiers that overflow (error for everything but
   strings; for strings they're equivalent to no precision/no limit).

Checking wide strings and floating point conversions for overflows
remains to be done.

As discussed before, none of these overflows are presently dangerous,
but they do lead to mildly wrong results in the relevant corner cases
and really should be fixed.


View attachment "printf-int-overflows.diff" of type "text/plain" (4336 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.