Bug 143322 - va_list with 1 arg in vsnprintf crahes process
va_list with 1 arg in vsnprintf crahes process
Product: Fedora
Classification: Fedora
Component: glibc (Show other bugs)
All Linux
medium Severity high
: ---
: ---
Assigned To: Jakub Jelinek
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2004-12-18 22:34 EST by Bertil Askelid
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-12-20 03:10:22 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Bertil Askelid 2004-12-18 22:34:33 EST
Description of problem:

vsnprintf(buffer,size,"%s","crash"); will cause a crash.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
Actual results:

Expected results:

Additional info:
Comment 1 Jakub Jelinek 2004-12-19 15:17:16 EST
Hmm, that's to be expected.  "crash" is not of type va_list.
Either you call snprintf(buffer, size, "%s", "crash");
or vsnprintf(buffer, size, "%s", ap); where ap has va_list type and has been
initialized by va_list or va_copy macros.
Comment 2 Bertil Askelid 2004-12-19 16:01:45 EST
Sorry, in all haste yesterday evening after a long day tracing down the bug,
I enterned the wrong example. Try this code and you will see that it crashes on
the call with one arg:

#include <stdio.h>
#include <stdarg.h>

static void p(char* line,size_t n,const char* format,va_list args) {
   vsnprintf(line,n,format,args); printf("%s\n",line);
static void p(char* line,size_t n,const char* format,...) {
   va_list args; va_start(args,format); p(line,n,format,args); va_end(args);

int main() {
   char line[128];

   snprintf(line,128,"Santa %s","Monica"); printf("%s\n",line);

   p(line,128,"%s %li","California",90404);
   p(line,128,"%s","North America");

   return 0;
Comment 3 Jakub Jelinek 2004-12-20 03:10:22 EST
That's still a bug in your testcase.
The standard doesn't say what type is va_list and on some arches GCC (as well as
other compilers) uses char *.  This is the case of e.g. i386.
But because you have p overloaded, then for p(line,128,"%s","North America");
p(char*, unsigned int, char const*, char*) is chosen (which is the one
with va_list), while for the other calls p(char*, unsigned int, char const*, ...).
Comment 4 Bertil Askelid 2004-12-20 10:32:16 EST
Looks like the standard has a limitation in not defining `va_list' as a unique
type. `va_list' and `char*' have different semantics, so why not acknowledge that?
Comment 5 Jakub Jelinek 2004-12-20 10:40:29 EST
ISO C99 just requires va_list to be an object type suitable for holding information needed by va_{start,end,copy,arg}.  ISO C++98 just requires va_list
to be a type in <cstdarg> and the same as in ISO C90 applies there.
Note that this can't be changed for binary compatibility reasons.

Note You need to log in before you can comment on or make changes to this bug.