CODEWITHSUNDEEP
cprintf
Nulik
Nulik

Reputation: 7360

snprintf() overflows specified length

I was writing my own ncurses library and suddenly I found in GDB that snprintf() returned length larger than I specified. Is this defined behaviour or some mistake of mine ? The (reproducible) snippet code is this:

niko: snippets $ cat snprintf.c
#include <unistd.h>
#include <stdio.h>

char *example_string="This is a very long label. It was created to test alignment functions of VERTICAL and HORIZONTAL layout";

void snprintf_test(void) {
    char tmp[72];
    char fmt[32];
    int len;
    unsigned short  x=20,y=30;

    snprintf(fmt,sizeof(fmt),"\033[%%d;%%dH\033[0m\033[48;5;%%dm%%%ds",48); 
    len=snprintf(tmp,sizeof(tmp),fmt,y,x,0,example_string);
    write(STDOUT_FILENO,tmp,len);
}


int main(void) {
    snprintf_test();
}
niko: snippets $

Now we compile with debugging info and run:

niko: snippets $ gcc -g -o snprintf snprintf.c
niko: snippets $ gdb ./snprintf -ex "break snprintf_test" -ex run
.....
Reading symbols from ./snprintf...done.
Breakpoint 1 at 0x40058e: file snprintf.c, line 10.
Starting program: /home/deptrack/depserv/snippets/snprintf 

Breakpoint 1, snprintf_test () at snprintf.c:10
10      unsigned short  x=20,y=30;
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.22-16.fc23.x86_64
(gdb) s
12      snprintf(fmt,sizeof(fmt),"\033[%%d;%%dH\033[0m\033[48;5;%%dm%%%ds",48); 
(gdb) print sizeof(fmt)
$1 = 32
(gdb) print sizeof(tmp)
$2 = 72
(gdb) s
13      len=snprintf(tmp,sizeof(tmp),fmt,y,x,0,example_string);
(gdb) print fmt
$3 = "\033[%d;%dH\033[0m\033[48;5;%dm%48s\000\000\000\000\000"
(gdb) print example_string
$4 = 0x4006c0 "This is a very long label. It was created to test alignment functions of VERTICAL and HORIZONTAL layout"
(gdb) s
14      write(STDOUT_FILENO,tmp,len);
(gdb) print len
$5 = 124
(gdb) print sizeof(tmp)
$6 = 72
(gdb)

The program outputs garbage at the end of the string. As you can see, the len variable returned from snprintf() is indicating that function has printed more than the allowed size of 72. Is this a bug or my mistake? If this behaviour is defined, then why snprintf() docs say it will print at most n characters. Very misleading and bug prone statement. I will have to write my own snprintf() to solve this problem.

Upvotes: 0

Views: 1164

Answers (1)

Snild Dolkow
Snild Dolkow

Reputation: 6866

Actually (from "man snprintf"):

If the output was truncated due to this limit then the return value is the number of characters (excluding the terminating null byte) which would have been written to the final string if enough space had been available.

Upvotes: 3

Related Questions