Buffer overflow within snprintf() and vsnprintf() functions

[jwrona]

Following code for appending string to the buffer using snprintf family of function may cause buffer overflow:

offset += snprintf(buffer + offset, MAX_STR_LEN - offset, "string");
offset += snprintf(buffer + offset, MAX_STR_LEN - offset, "string2");

The second argument of snprintf is size_t, it means that if offset > MAX_STR_LEN, then MAX_STR_LEN - offset will underflow and snprintf() will write outside of the buffer creating a buffer overflow. This is because snprintf() and vsnprintf() does not return the number of characters written, but If the number of characters which would have been written to the final string if enough space had been available.

It is used in print.c and output.c.