Possible null pointer dereference.

[Lawliar]

Hi, first of all great work there, really useful library.

I found this weird situation where there is a null pointer dereference. More specifically, if you specify "%s%s%s" as the format string without parameters, the 3rd formater will cause a null pointer dereference, which leads to a seg fault, while "%s", "%s%s" will work just fine. I know it's kinda silly to specify format string without parameters, but vsnprintf works just fine for this situation, and this can be fixed easily with a checking whether the pointer is null or not. So I'm wondering if this worth looking into? (similar thing happens to %n as well).

[MaJerle]

Behavior you see is normally undefined and is compiler-stdlib specific. So vsnprintf may work in one compiler, but fail on another (or for another arch).

I will look into it

[MaJerle]

So to come back - if you do not specify parameters, then variable parameter function grabs whatever is next on stack. It can be a NULL, or something else from prior function calls, depends on the stack depth used up to the call of sprintf. Even if address is NON-NULL, it may still end-up in failure, if this address points to area of memory with no access for read operation..

This is typical undefined behavior and application miss-use.

There will be no correction at library level.

[Lawliar]

I see, thanks for this analysis, really appreciate it.