When the output buffer is full (str >= end), bstr_printf() skips
advancing the args pointer past the pre-rendered pointer string in
bin_buf. This causes all subsequent format specifiers to read from
the wrong position, corrupting the rest of the output.

Always compute the string length and advance args regardless of
whether there is space to copy into the output buffer.

Signed-off-by: Josh Law <objecting@objecting.org>
---
 lib/vsprintf.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 800b8ac49f53..7898fb998b21 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -3389,14 +3389,15 @@ int bstr_printf(char *buf, size_t size, const char *fmt_str, const u32 *bin_buf)
 					break;
 				}
 				/* Pointer dereference was already processed */
+				len = strlen(args);
 				if (str < end) {
-					len = copy = strlen(args);
+					copy = len;
 					if (copy > end - str)
 						copy = end - str;
 					memcpy(str, args, copy);
-					str += len;
-					args += len + 1;
 				}
+				str += len;
+				args += len + 1;
 			}
 			if (process)
 				str = pointer(fmt.str, str, end, get_arg(void *), spec);
-- 
2.34.1

On 30/03/2026 21:34, Josh Law wrote:
> When the output buffer is full (str >= end), bstr_printf() skips
> advancing the args pointer past the pre-rendered pointer string in
> bin_buf. This causes all subsequent format specifiers to read from
> the wrong position, corrupting the rest of the output.
> 
> Always compute the string length and advance args regardless of
> whether there is space to copy into the output buffer.
> 
> Signed-off-by: Josh Law <objecting@objecting.org>

NAK

Questionably origin (multiple identities used), questionable content.

Best regards,
Krzysztof

On Tue, 31 Mar 2026 09:26:46 +0200
Krzysztof Kozlowski <krzk@kernel.org> wrote:

> On 30/03/2026 21:34, Josh Law wrote:
> > When the output buffer is full (str >= end), bstr_printf() skips
> > advancing the args pointer past the pre-rendered pointer string in
> > bin_buf. This causes all subsequent format specifiers to read from
> > the wrong position, corrupting the rest of the output.
> > 
> > Always compute the string length and advance args regardless of
> > whether there is space to copy into the output buffer.
> > 
> > Signed-off-by: Josh Law <objecting@objecting.org>  
> 
> NAK
> 
> Questionably origin (multiple identities used), questionable content.

Can you expand further on this complaint?

-- Steve