This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 0938cbacff04ad8883f7346e3bdb4b83a7d0b5c4 Author: Marco Casaroli <[email protected]> AuthorDate: Thu Nov 5 06:51:55 2026 +0100 libs/libc/stream: Do not truncate the length of an integer conversion. vsprintf_internal() kept the length of an integer conversion in an unsigned char. A width above 255 is truncated, but the padding uses the full width: "%300d" wrote 556 bytes and "%4095d" wrote 7935 bytes. A sprintf() into a buffer that has the size of the width overflows. Use an unsigned int. It holds a width of INT_MAX and the prefix. Part of https://github.com/apache/nuttx/issues/21467 Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- libs/libc/stream/lib_libvsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libs/libc/stream/lib_libvsprintf.c b/libs/libc/stream/lib_libvsprintf.c index 3455bd8e017..d1b83053701 100644 --- a/libs/libc/stream/lib_libvsprintf.c +++ b/libs/libc/stream/lib_libvsprintf.c @@ -226,7 +226,7 @@ static int vsprintf_internal(FAR struct lib_outstream_s *stream, size_t size; int ch; int star; - unsigned char len; + unsigned int len; int total_len = 0; #ifdef CONFIG_LIBC_NUMBERED_ARGS
