side effect of using sprintf in C with buffer overrun

Question

Is the following going to cause problems?

my_func()
{
  char date_field[11];
  time_t current_time;

  time(&current_time);

  sprintf(date_field, "%0.3d%0.3d%.02d%0.2d\0", current_time.tm_yday,
      current_time.tm_year, current_time.tm_hour, current_time.tm_min);

  ...
}

I realize that this may overrun the date_field buffer... What I'm concerned about is the side effect of this occurring? I.e.: a core dump? How to trap/catch this kind of issue?

Why be mean with the buffer size? If the numbers happen to break the width specifications, you will overrun the buffer. Just allow plenty then you need not be concerned about side-effects. Are you really short of a few bytes? BTW you do not need to write an explicit \0 because sprintf does this for you. — Weather Vane
– Weather Vane, Commented Jul 16, 2016 at 18:21
Why not use snprintf which will both guarantee the null and guarantee to never overrun? — David Hoelzer
– David Hoelzer, Commented Jul 16, 2016 at 18:24
You could also guarantee a fit by taking the modulus of the data, to guard against garbage in. Like current_time.tm_yday % 1000 etc. Also use %u format then you won't get unexpected - signs. — Weather Vane
– Weather Vane, Commented Jul 16, 2016 at 18:29
If you want to know if you overflowed the buffer, test the return value from sprintf (if it has not already crashed), which must be, at most, one less than the buffer size. — Weather Vane
– Weather Vane, Commented Jul 16, 2016 at 18:36
Code does not compile. time_t current_time; and current_time.tm_yday is not valid C code. — chux
– chux, Commented Jul 17, 2016 at 5:11

chqrlie · Accepted Answer · 2016-07-16 22:22:57Z

1

As currently written, your code does not compile: current_time is a time_t, not a struct tm. How do you compute the tm structure and how do you use it? If this structure is not properly initialized, the sprintf() may invoke undefined behavior, which means anything can happen, but this would require some of the fields to be out of range.

It is vain to try and elaborate on side effects from such a small and inaccurate code fragment.

Fix the code by making the buffer larger, and use snprintf instead of sprintf and ensure the tm structure is correctly computed. An invalid date_time string, even without a buffer overflow, may cause other problems elsewhere in the code or in the database itself... Posting more code would help investigate.

Do you know more about the actual crash? Do you have a register dump?

edited Jul 16, 2016 at 22:22

answered Jul 16, 2016 at 18:31

chqrlie

152k12 gold badges145 silver badges231 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

user3053087 Over a year ago

what we are experiencing is random crashing. happens days, sometimes months before it occurs. the date_time field is used as a field in a data write to an isam file. the file grows exponentially large when this happens. I expect the extra null is blowing a pointer and causing havoc.

chqrlie Over a year ago

@user3053087: what are you trying to explain? There is a bug in the code posted. The actual function probably has more local data and more code around the offending code, it might have more bugs too. Writing beyond the end of a buffer with automatic storage is likely to overwrite some other variables or worse part of the stack frame... What you describe are potential consequences of undefined behavior. Is anything preventing you from fixing the code? Are you trying to assess whether this bug explains the behavior? It is possible but something else may be happening too.

user3053087 Over a year ago

yes, trying to assess if this code is accounting for what we are seeing. changes to be made tomorrow and test.

chqrlie Over a year ago

I changed my answer, the code does not make sense as written, please post the actual code.

user3053087 Over a year ago

the problem as experienced by the application users is lines fail when trying to insert new records into the isam file affected. it grows to an unimaginally large file size (130G) and then all processes attempting to write to the file get a c-isam error 107. curiously, the filesystem hosting the database files only has 9.2G space. sounds like a pointer off into space issue.

|

Collectives™ on Stack Overflow

side effect of using sprintf in C with buffer overrun

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related