This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 91266561c6a1cb2e2ccc51b7483179c902bb1fa9 Author: huojianchao <[email protected]> AuthorDate: Fri Sep 26 17:21:37 2025 +0800 libc/backtrace: do not count a truncated entry in backtrace_format() backtrace_format() formatted an entry whenever its start fitted in the buffer. snprintf() returns the length it would have written, so for an entry cut off at the end of the buffer the returned length also counted the missing part and could exceed the buffer size. proc_groupfd() adds the returned length to linesize, writes the newline at linesize - 1 and copies linesize bytes out of procfile->line. With CONFIG_FS_BACKTRACE and a long file path this wrote and read past the end of the line buffer. Only format an entry when it fits completely, including the terminating NUL, so that the returned length matches the string in the buffer. Signed-off-by: huojianchao <[email protected]> --- libs/libc/misc/lib_backtrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libs/libc/misc/lib_backtrace.c b/libs/libc/misc/lib_backtrace.c index 31e74a10e20..c2ba3887c3f 100644 --- a/libs/libc/misc/lib_backtrace.c +++ b/libs/libc/misc/lib_backtrace.c @@ -480,7 +480,7 @@ int backtrace_format(FAR char *buffer, int size, buffer[0] = '\0'; for (i = 0; i < depth && backtrace[i]; i++) { - if (i * BACKTRACE_PTR_FMT_WIDTH >= size) + if ((i + 1) * BACKTRACE_PTR_FMT_WIDTH >= size) { break; }
