_  _    __    ___  __    ___  _____  _  _
 ( \( )  /__\  / __)(  )  / __)(  _  )( \( )
  )  (  /(__)\( (__  )(__( (__  )(_)(  )  (
 (_)\_)(__)(__)\___)(____)\___)(_____)(_)\_)

The History of Hacking  ·  May 31 – June 2, 2026  ·  Carolina Beach, NC

Connect from your terminal: telnet naclconbbs.net 23  |  ssh naclconbbs.net -p 2222

  1. Forum
  2. DOVE-Net
  3. Synchronet Programming

  • src/xpdev/SNPRINTF_AUDIT.md

    From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Tue Jul 21 01:41:46 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/a1720ea9f6d2f2fa0b0969f2
    Added Files:
    src/xpdev/SNPRINTF_AUDIT.md
    Log Message:
    xpdev: scope the snprintf() return-value divergence for a future fix

    genwrap.h redefines snprintf() to safe_snprintf() unless USE_SNPRINTF is defined, and safe_snprintf() clamps its return to size-1 rather than
    returning C99's would-be length. USE_SNPRINTF is set for darwin and freebsd only (Common.gmake), and sbbs3 inherits those flags -- so the return value means the would-be length on macOS/FreeBSD and the truncated length on Linux and Windows. The same source line behaves differently per platform, with no diagnostic either way.

    That is not a theoretical problem: main.cpp's unix-domain spy-socket path
    check (`snprintf(...) >= sizeof(sun_path)`) is correct on macOS/FreeBSD and UNREACHABLE on Linux, where an over-long temp_dir silently binds a truncated socket path instead of logging the error and skipping the node.

    The obvious fix -- make safe_snprintf() conformant -- is wrong as a first
    move: ~32 callers accumulate with `d += snprintf(...)` and depend on the
    clamp to stay inside the buffer, so removing it trades one silent truncation for a set of overruns.

    No code changed. This records the platform matrix, the confirmed bug, why
    each of the four available fixes is or isn't safe, and a recommended inventory-first path, so the work can be picked up without re-deriving any
    of it.

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net