[src/kservice.c] 修复 rt_vsnprintf 格式化后宽度不正确的问题

[src/kservice.c] 修复 rt_vsnprintf 处理 size 和 buf 为 0 极端情况的 bug (对 0 地址写入)

Signed-off-by: MurphyZhao <d2014zjt@163.com>
This commit is contained in:
MurphyZhao 2019-03-23 16:36:54 +08:00
parent 1b0f7db7c3
commit 0f673df08a
1 changed files with 29 additions and 23 deletions

View File

@ -668,7 +668,7 @@ static char *print_number(char *buf,
while (size-- > 0) while (size-- > 0)
{ {
if (buf <= end) if (buf < end)
*buf = ' '; *buf = ' ';
++ buf; ++ buf;
} }
@ -676,11 +676,11 @@ static char *print_number(char *buf,
if (sign) if (sign)
{ {
if (buf <= end) if (buf < end)
{ {
*buf = sign; *buf = sign;
-- size;
} }
-- size;
++ buf; ++ buf;
} }
@ -689,16 +689,16 @@ static char *print_number(char *buf,
{ {
if (base == 8) if (base == 8)
{ {
if (buf <= end) if (buf < end)
*buf = '0'; *buf = '0';
++ buf; ++ buf;
} }
else if (base == 16) else if (base == 16)
{ {
if (buf <= end) if (buf < end)
*buf = '0'; *buf = '0';
++ buf; ++ buf;
if (buf <= end) if (buf < end)
{ {
*buf = type & LARGE ? 'X' : 'x'; *buf = type & LARGE ? 'X' : 'x';
} }
@ -712,7 +712,7 @@ static char *print_number(char *buf,
{ {
while (size-- > 0) while (size-- > 0)
{ {
if (buf <= end) if (buf < end)
*buf = c; *buf = c;
++ buf; ++ buf;
} }
@ -721,7 +721,7 @@ static char *print_number(char *buf,
#ifdef RT_PRINTF_PRECISION #ifdef RT_PRINTF_PRECISION
while (i < precision--) while (i < precision--)
{ {
if (buf <= end) if (buf < end)
*buf = '0'; *buf = '0';
++ buf; ++ buf;
} }
@ -730,14 +730,14 @@ static char *print_number(char *buf,
/* put number in the temporary buffer */ /* put number in the temporary buffer */
while (i-- > 0 && (precision_bak != 0)) while (i-- > 0 && (precision_bak != 0))
{ {
if (buf <= end) if (buf < end)
*buf = tmp[i]; *buf = tmp[i];
++ buf; ++ buf;
} }
while (size-- > 0) while (size-- > 0)
{ {
if (buf <= end) if (buf < end)
*buf = ' '; *buf = ' ';
++ buf; ++ buf;
} }
@ -769,7 +769,7 @@ rt_int32_t rt_vsnprintf(char *buf,
#endif #endif
str = buf; str = buf;
end = buf + size - 1; end = buf + size;
/* Make sure end is always >= buf */ /* Make sure end is always >= buf */
if (end < buf) if (end < buf)
@ -782,7 +782,7 @@ rt_int32_t rt_vsnprintf(char *buf,
{ {
if (*fmt != '%') if (*fmt != '%')
{ {
if (str <= end) if (str < end)
*str = *fmt; *str = *fmt;
++ str; ++ str;
continue; continue;
@ -863,20 +863,20 @@ rt_int32_t rt_vsnprintf(char *buf,
{ {
while (--field_width > 0) while (--field_width > 0)
{ {
if (str <= end) *str = ' '; if (str < end) *str = ' ';
++ str; ++ str;
} }
} }
/* get character */ /* get character */
c = (rt_uint8_t)va_arg(args, int); c = (rt_uint8_t)va_arg(args, int);
if (str <= end) *str = c; if (str < end) *str = c;
++ str; ++ str;
/* put width */ /* put width */
while (--field_width > 0) while (--field_width > 0)
{ {
if (str <= end) *str = ' '; if (str < end) *str = ' ';
++ str; ++ str;
} }
continue; continue;
@ -894,21 +894,21 @@ rt_int32_t rt_vsnprintf(char *buf,
{ {
while (len < field_width--) while (len < field_width--)
{ {
if (str <= end) *str = ' '; if (str < end) *str = ' ';
++ str; ++ str;
} }
} }
for (i = 0; i < len; ++i) for (i = 0; i < len; ++i)
{ {
if (str <= end) *str = *s; if (str < end) *str = *s;
++ str; ++ str;
++ s; ++ s;
} }
while (len < field_width--) while (len < field_width--)
{ {
if (str <= end) *str = ' '; if (str < end) *str = ' ';
++ str; ++ str;
} }
continue; continue;
@ -931,7 +931,7 @@ rt_int32_t rt_vsnprintf(char *buf,
continue; continue;
case '%': case '%':
if (str <= end) *str = '%'; if (str < end) *str = '%';
++ str; ++ str;
continue; continue;
@ -953,12 +953,12 @@ rt_int32_t rt_vsnprintf(char *buf,
break; break;
default: default:
if (str <= end) *str = '%'; if (str < end) *str = '%';
++ str; ++ str;
if (*fmt) if (*fmt)
{ {
if (str <= end) *str = *fmt; if (str < end) *str = *fmt;
++ str; ++ str;
} }
else else
@ -995,8 +995,14 @@ rt_int32_t rt_vsnprintf(char *buf,
#endif #endif
} }
if (str <= end) *str = '\0'; if (size > 0)
else *end = '\0'; {
if (str < end) *str = '\0';
else
{
end[-1] = '\0';
}
}
/* the trailing null byte doesn't count towards the total /* the trailing null byte doesn't count towards the total
* ++str; * ++str;