[PATCH i-g-t v4 3/4] lib/igt_sysfs: Fix off-by-one in buffer size

Lucas De Marchi lucas.demarchi at intel.com
Wed Feb 28 22:31:33 UTC 2024


vsnprintf() should receive the buffer size as argument, here called `len`,
including the trailing '\0'. There was truncation if the return is "size
or more". In this second call to vsnprintf() the value should be exactly
the same as in the first call, otherwise something really unexpected
happened.

Signed-off-by: Lucas De Marchi <lucas.demarchi at intel.com>
---
 lib/igt_sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/igt_sysfs.c b/lib/igt_sysfs.c
index 2997925e5..a1ff5655d 100644
--- a/lib/igt_sysfs.c
+++ b/lib/igt_sysfs.c
@@ -529,8 +529,8 @@ int igt_sysfs_vprintf(int dir, const char *attr, const char *fmt, va_list ap)
 			goto end;
 		}
 
-		ret = vsnprintf(buf, ret, fmt, ap);
-		if (igt_debug_on(ret > len)) {
+		ret = vsnprintf(buf, len, fmt, ap);
+		if (igt_debug_on(ret != len - 1)) {
 			ret = -EINVAL;
 			goto free_buf;
 		}
-- 
2.43.0



More information about the igt-dev mailing list