When the output buffer is full (str >= end), bstr_printf() skips
advancing the args pointer past the pre-rendered pointer string in
bin_buf. This causes all subsequent format specifiers to read from
the wrong position, corrupting the rest of the output.

Always compute the string length and advance args regardless of
whether there is space to copy into the output buffer.

Signed-off-by: Josh Law <objecting@objecting.org>
---
 lib/vsprintf.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 800b8ac49f53..7898fb998b21 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -3389,14 +3389,15 @@ int bstr_printf(char *buf, size_t size, const char *fmt_str, const u32 *bin_buf)
 					break;
 				}
 				/* Pointer dereference was already processed */
+				len = strlen(args);
 				if (str < end) {
-					len = copy = strlen(args);
+					copy = len;
 					if (copy > end - str)
 						copy = end - str;
 					memcpy(str, args, copy);
-					str += len;
-					args += len + 1;
 				}
+				str += len;
+				args += len + 1;
 			}
 			if (process)
 				str = pointer(fmt.str, str, end, get_arg(void *), spec);
-- 
2.34.1

On Tue 2026-03-24 22:49:37, Josh Law wrote:
> When the output buffer is full (str >= end), bstr_printf() skips
> advancing the args pointer past the pre-rendered pointer string in
> bin_buf. This causes all subsequent format specifiers to read from
> the wrong position, corrupting the rest of the output.
> 
> Always compute the string length and advance args regardless of
> whether there is space to copy into the output buffer.
> 
> Signed-off-by: Josh Law <objecting@objecting.org>

It looks correct to me. It is interesting that nobody found it yet.
But I guess that all users of bstr_printf() are using big enough
buffers so that it is hard to hit in practice.

Reviewed-by: Petr Mladek <pmladek@suse.com>

Best Regards,
Petr