casaroli commented on issue #21467:
URL: https://github.com/apache/nuttx/issues/21467#issuecomment-6649036474
@anchao Thanks for the reply. We agree: safety is a tradeoff with flash
size, and small devices must not pay for it without a reason.
We do not aim to make `printf` work with wrong usage. If the caller passes
an argument of the wrong type for its conversion, or a bad pointer for `%s`,
`printf` cannot detect it, and that remains the developer's bug. Unknown
conversions and truncated formats are wrong usage too, so they are not part of
this step. They can come later, behind an option.
What we want is this: if `printf` is used correctly, it never crashes, in
any configuration. A correct call must be safe even when the feature is
disabled. For example, passing a `long double` or a `double` to a minimal
`printf` must read the argument at its right size and print `?` in the worst
case, so the arguments after it stay correct. Today it does not hold:
- `printf("%a|%s", 1.0, "x")` on arm64: `%a` reads an integer, so `%s` gets
a wrong pointer. 27 tests of the suite crash this way on sim arm64.
- `sprintf(buf, "%300d", 1)` writes 556 bytes, not 300, past a correctly
sized buffer.
In our measurements so far, the first step of the plan costs at most 152
bytes of image text on Cortex-M0 and 232 on Cortex-M3, with float and numbered
arguments on or off. Larger features come later, behind options that are off by
default, so they do not grow the small boards.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
