Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

lib/vsprintf.c: improve sanity check in vsnprintf()

On 64 bit, size may very well be huge even if bit 31 happens to be 0.
Somehow it doesn't feel right that one can pass a 5 GiB buffer but not a
3 GiB one. So cap at INT_MAX as was probably the intention all along.
This is also the made-up value passed by sprintf and vsprintf.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Rasmus Villemoes and committed by
Linus Torvalds
2aa2f9e2 ffbfed03

+1 -1
+1 -1
lib/vsprintf.c
··· 1727 1727 1728 1728 /* Reject out-of-range values early. Large positive sizes are 1729 1729 used for unknown buffer sizes. */ 1730 - if (WARN_ON_ONCE((int) size < 0)) 1730 + if (WARN_ON_ONCE(size > INT_MAX)) 1731 1731 return 0; 1732 1732 1733 1733 str = buf;