>Number:         35401
>Category:       lib
>Synopsis:       snprintf(3) returns negative values for looong strings
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 10 23:45:00 +0000 2007
>Originator:     Andreas Wiese
>Release:        NetBSD 4.99.7
>Organization:
	BSD-Crew Dresden
>Environment:
System: NetBSD schroeder.lan.instandbesetzt.net 4.99.7 NetBSD 4.99.7 (SCHROEDER) #0: Mon Jan 8 22:11:15 CET 2007 root@schroeder.lan.instandbesetzt.net:/sys/arch/i386/compile/SCHROEDER i386
Architecture: i386
Machine: i386
>Description:
Inspired by http://blog.fefe.de/?ts=bb5b972c I tried what snprintf(3)
returns for very, very long strings:

#v+
aw@schroeder:~> cat test.c
#include <stdio.h>
#include <string.h>
#include <errno.h>

int
main(void)
{
	errno = 0;
	printf("%d\n", snprintf(NULL, 0, "%*d%*d", 0x40000000, 1,
					0x40000000, 1));
	printf("%d (%s)\n", errno, strerror(errno));

	return 0;
}
aw@schroeder:~> gcc -W -Wall -Werror -pedantic-errors test.c
aw@schroeder:~> time ./a.out
-2147483648
0 (Undefined error: 0)
./a.out  8.89s user 0.03s system 79% cpu 11.248 total
aw@schroeder:~> 
#v-

Since errno is not set, I think this isn't recognized as an error (even
with negative return value).  Could be naughty, couldn't it?

But hey, at least it doesn't waste 1GB of RAM and 17secs like the GNU
implementation ;)
	
>How-To-Repeat:
n/a
>Fix:
n/a

HAND & LG -- aw
--