Bug 3556 - ntp_loopfilter.c snprintf compilation warnings

 - stricter buffer range checks

bk: 5c0768f5h8VGGD54q8GyLWOkcqjZIw

diff --git a/libntp/xsbprintf.c b/libntp/xsbprintf.c
index e7d197591983d6d417ad92b456208d40026a6d58..4586758bc88aa1f704136aaa9a7b4da8383dad69 100644 (file)
--- a/libntp/xsbprintf.c
+++ b/libntp/xsbprintf.c
@@ -26,6 +26,7 @@
  *   changed. (Bytes in the buffer might be smashed, but the buffer
  *   position does not change, and the NUL marker stays in place at the
  *   current buffer position.)
+ * - If '(*ppbuf - pend) <= 0' (or ppbuf is NULL), fail with EINVAL.
  */
 int
 xvsbprintf(
@@ -37,18 +38,15 @@ xvsbprintf(
 {
        char *pbuf = (ppbuf) ? *ppbuf : NULL;
        int   rc   = -1;
-       if (pbuf) {
-               size_t ilen = (size_t)(pend - pbuf);
-               if (ilen) {
-                       *pbuf = '\0';
-                       rc    = vsnprintf(pbuf, ilen, pfmt, va);
-                       if (rc > 0) {
-                               if ((size_t)rc >= ilen)
-                                       rc = 0;
-                               pbuf += rc;
-                       }
-                       *pbuf = '\0'; /* fear of bad vsnprintf */
-               }               
+       if (pbuf && (pend - pbuf > 0)) {
+               size_t blen = (size_t)(pend - pbuf);
+               rc = vsnprintf(pbuf, blen, pfmt, va);
+               if (rc > 0) {
+                   if ((size_t)rc >= blen)
+                       rc = 0;
+                   pbuf += rc;
+               }
+               *pbuf = '\0'; /* fear of bad vsnprintf */
                *ppbuf = pbuf;
        } else {
                errno = EINVAL;
@@ -56,7 +54,7 @@ xvsbprintf(
        return rc;
 }
 
-/* variadic wrapper around the buufer string formatter */
+/* variadic wrapper around the buffer string formatter */
 int
 xsbprintf(
        char       **ppbuf,     /* pointer to buffer pointer (I/O) */

diff --git a/tests/libntp/run-sbprintf.c b/tests/libntp/run-sbprintf.c
index a3c1661c11f6a748fa4cf4c6e23a9c56cacc32f5..996139613f5c7fc20b5d6f37ba9e472866def2bf 100644 (file)
--- a/tests/libntp/run-sbprintf.c
+++ b/tests/libntp/run-sbprintf.c
@@ -31,10 +31,12 @@ extern void setUp(void);
 extern void tearDown(void);
 extern void test_NullBuf1(void);
 extern void test_NullBuf2(void);
+extern void test_EndBeyond(void);
 extern void test_SmallBuf(void);
 extern void test_MatchBuf(void);
 extern void test_BigBuf(void);
 extern void test_SimpleArgs(void);
+extern void test_Increment1(void);
 
 
 //=======Suite Setup=====
@@ -63,10 +65,12 @@ int main(int argc, char *argv[])
   UnityBegin("sbprintf.c");
   RUN_TEST(test_NullBuf1, 7);
   RUN_TEST(test_NullBuf2, 14);
-  RUN_TEST(test_SmallBuf, 23);
-  RUN_TEST(test_MatchBuf, 34);
-  RUN_TEST(test_BigBuf, 45);
-  RUN_TEST(test_SimpleArgs, 56);
+  RUN_TEST(test_EndBeyond, 23);
+  RUN_TEST(test_SmallBuf, 33);
+  RUN_TEST(test_MatchBuf, 44);
+  RUN_TEST(test_BigBuf, 55);
+  RUN_TEST(test_SimpleArgs, 66);
+  RUN_TEST(test_Increment1, 78);
 
   return (UnityEnd());
 }

diff --git a/tests/libntp/sbprintf.c b/tests/libntp/sbprintf.c
index 6df42639e3a4d8c6ab94c6f33964c8d336f34832..c3672743e6ce58f64b2d1704d0eb5b0ef7ad3962 100644 (file)
--- a/tests/libntp/sbprintf.c
+++ b/tests/libntp/sbprintf.c
@@ -20,6 +20,16 @@ void test_NullBuf2(void)
        TEST_ASSERT_EQUAL_PTR(bp, NULL);
 }
 
+extern void test_EndBeyond(void);
+void test_EndBeyond(void)
+{
+       char ba[2];
+       char *bp = ba + 1;
+       char *ep = ba;
+       int rc = xsbprintf(&bp, ep, "blah");
+        TEST_ASSERT(rc == -1 && errno == EINVAL);
+}
+
 extern void test_SmallBuf(void);
 void test_SmallBuf(void)
 {
@@ -65,3 +75,21 @@ void test_SimpleArgs(void)
        TEST_ASSERT_FALSE(strcmp(ba, "1234"));
 }
 
+extern void test_Increment1(void);
+void test_Increment1(void)
+{
+       char  ba[10];
+       char *bp = ba;
+       char *ep = ba + sizeof(ba);
+       int   rc;
+
+       rc = xsbprintf(&bp, ep, "%d%d%d%d", 1, 2, 3, 4);
+        TEST_ASSERT(rc == 4 && strlen(ba) == 4);
+       TEST_ASSERT_EQUAL_PTR(bp, ba + 4);
+
+       rc = xsbprintf(&bp, ep, "%s", "frob");
+        TEST_ASSERT(rc == 4 && strlen(ba) == 8);
+       TEST_ASSERT_EQUAL_PTR(bp, ba + 8);
+       TEST_ASSERT_FALSE(strcmp(ba, "1234frob"));
+}
+