This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit f8d6ea002f99f2a8ab4aea854b95f29e39f3f658 Author: Marco Casaroli <[email protected]> AuthorDate: Mon Nov 9 15:07:26 2026 +0100 libs/libc/stream: Print nothing for %n when LIBC_PRINTF_PERCENT_N is off. Since #21474, printf() takes the pointer of %n, stores nothing and prints "?" when LIBC_PRINTF_PERCENT_N is off. But the correct output of %n is empty, so "?" changes the text and the return value of the call. The safety comes from the missing store, not from the "?". Now %n prints nothing also with the option off. It still reads its pointer and stores nothing. With the option on nothing changes: %n stores the count and prints nothing. A width or flags on %n have no effect, as C leaves them undefined. Update the help of the option. Part of https://github.com/apache/nuttx/issues/21467 Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- libs/libc/stdio/Kconfig | 3 ++- libs/libc/stream/lib_libvsprintf.c | 9 +++------ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/libs/libc/stdio/Kconfig b/libs/libc/stdio/Kconfig index 121e2a70ca3..87edeb26e82 100644 --- a/libs/libc/stdio/Kconfig +++ b/libs/libc/stdio/Kconfig @@ -157,7 +157,8 @@ config LIBC_PRINTF_PERCENT_N that an attacker can change then gives a write to any address. Keep it off unless a program needs it. No profile turns it on. - Without it, printf() reads the pointer, stores nothing and prints "?". + Without it, printf() reads the pointer, stores nothing and prints + nothing. config LIBC_FLOATINGPOINT bool "Enable floating point in printf" diff --git a/libs/libc/stream/lib_libvsprintf.c b/libs/libc/stream/lib_libvsprintf.c index ce924ddf375..a7f2d3e3561 100644 --- a/libs/libc/stream/lib_libvsprintf.c +++ b/libs/libc/stream/lib_libvsprintf.c @@ -1781,19 +1781,16 @@ put_unavailable: pnt = va_arg(ap, FAR char *); } - /* %n only takes its pointer: a format never writes to memory, - * unless the option says so. + /* %n prints nothing. Only the option lets it store the count: + * else a format never writes to memory. */ if (c == 'n') { #ifdef CONFIG_LIBC_PRINTF_PERCENT_N vsprintf_store((FAR void *)pnt, flags, total_len); - continue; #endif - pnt = "?"; - size = 1; - goto str_lpad; + continue; } if (pnt == NULL)
