This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 6f5fb2d9f7ec0da31add21db4f7008cc7046fa04 Author: Marco Casaroli <[email protected]> AuthorDate: Thu Nov 5 06:51:54 2026 +0100 libs/libc/stream: Take the pointer of %n and print a question mark. printf() has no %n. It went to the path of the unknown conversions. This path takes an unsigned int, or with %lln a long long, and prints the conversion as text. The argument is a pointer. On a 32-bit CPU %hhn and %lln take the wrong size, and the next arguments are wrong: a later %s then uses a value that is not a pointer. Take the pointer for %n of any length, and print "?", padded to the width. Do not store through it, so a format string cannot write to memory, and the output shows that the count is not available. Part of https://github.com/apache/nuttx/issues/21467 Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- libs/libc/stream/lib_libvsprintf.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libs/libc/stream/lib_libvsprintf.c b/libs/libc/stream/lib_libvsprintf.c index b2362001b54..5cde9dd6150 100644 --- a/libs/libc/stream/lib_libvsprintf.c +++ b/libs/libc/stream/lib_libvsprintf.c @@ -1034,6 +1034,7 @@ flt_oper: pnt = buf; goto str_lpad; + case 'n': case 's': case 'S': #ifdef CONFIG_LIBC_NUMBERED_ARGS @@ -1047,6 +1048,15 @@ flt_oper: pnt = va_arg(ap, FAR char *); } + /* %n only takes its pointer: a format never writes to memory */ + + if (c == 'n') + { + pnt = "?"; + size = 1; + goto str_lpad; + } + if (pnt == NULL) { pnt = g_nullstring;
