[SOLVED] Will vprintf == vsprintf using the same parameters?

Soderlund · 09-16-2013, 01:06 PM

vprintf and vsprintf return the amount of characters written.

I know that you should not use vsprintf due to the risk of buffer overflow, but if vprintf is guaranteed to return the same amount of characters as vsprintf will write (using exactly the same parameters), then it should be safe, right? Like this:

Code:

int printed = vprintf(<params>);
char * buffer = malloc(sizeof(* buffer) * (printed + 1));
vsprintf(buffer, <params>); /* == printed and thus overflow is not possible? */

Assuming params are the same.

I suspect this might not always work since (v)printf writes to stdout while (v)sprintf writes to a buffer.

NevemTeve · 09-16-2013, 01:25 PM

Use [v]asprintf instead.

mina86 · 09-16-2013, 01:25 PM

What's the point? Just use vsnprintf and you don't have to worry about any edge cases.

Quote:

Originally Posted by NevemTeve

Use [v]asprintf instead.

It's worth remembering it's a GNU extension though.

Soderlund · 09-16-2013, 03:02 PM

Quote:

Originally Posted by mina86

What's the point? Just use vsnprintf and you don't have to worry about any edge cases.

It's written in C89.

Soderlund · 09-17-2013, 10:34 AM

I dusted off the standard and I think it settles it:

Quote:

The fprintf function returns the number of characters transmitted, or a negative value if an output error occured.

Quote:

The sprintf function is equivalent to fprintf, except that the argument s specifies an array into which the generated output is to be written, rather than to a stream. A null character is written at the end of the characters written; it is not counted as part of the returned sum.

Quote:

The sprintf function returns the number of characters written in the array, not counting the terminating null character.

"Transmitted" must mean the amount of characters that the program attempts to write to stdout, regardless if stdout successfully outputs all characters, as opposed to "written", which is used to describe sprintf.

(I should have checked this before asking but cppreference.com says "returns number of characters written" for both.)

Obviously not a good general solution for sprintf but in my case I have to write the same thing to stdout and a buffer, so this works perfectly for me. I think.

mina86 · 09-18-2013, 12:49 PM

Quote:

Originally Posted by Soderlund

It's written in C89.

I would question if there is any valid reason for sticking to C89, but cannot comment without knowing the project of course.