Re: [PATCH v2 1/2] lib/vsprintf: Fix to check field_width and precision

[Google]

On Fri, 20 Mar 2026 09:48:58 +0000
David Laight <david.laight.linux@xxxxxxxxx> wrote:

> On Fri, 20 Mar 2026 12:54:48 +0900
> "Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx> wrote:
> 
> > From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> > 
> > Check the field_width and presition correctly. Previously it depends
> > on the bitfield conversion from int to check out-of-range error.
> > However, commit 938df695e98d ("vsprintf: associate the format state
> > with the format pointer") changed those fields to int.
> > We need to check the out-of-range correctly without bitfield
> > conversion.
> > 
> > Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer")
> > Reported-by: David Laight <david.laight.linux@xxxxxxxxx>
> > Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> > ---
> >  Changes in v2:
> >   - Fix to use logical split.
> > ---
> >  lib/vsprintf.c |    6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > index 800b8ac49f53..32a164e2adf4 100644
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -2803,7 +2803,8 @@ static void
> >  set_field_width(struct printf_spec *spec, int width)
> >  {
> >  	spec->field_width = width;
> > -	if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
> > +	if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,
> 
> Check and update width before the assignment to spec->field_width.
> 
> 	David

Indeed. I'll do the same for precision.

Thanks,

> 
> > +		      "field width %d too large", width)) {
> >  		spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
> >  	}
> >  }
> > @@ -2812,7 +2813,8 @@ static void
> >  set_precision(struct printf_spec *spec, int prec)
> >  {
> >  	spec->precision = prec;
> > -	if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
> > +	if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
> > +		      "precision %d too large", prec)) {
> >  		spec->precision = clamp(prec, 0, PRECISION_MAX);
> >  	}
> >  }
> > 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>