fix: use snprintf in sprintf.c

lib/src/sprintf.c

@@ -19,3 +19,34 @@ int sprintf(char *dst, const char *fmt, ...) {
 char *proutSprintf(char *dst, const char *src, size_t count) {
     return (char *) memcpy((u8 *) dst, (u8 *) src, count) + count;
 }
+
+typedef struct {
+    char *ptr;
+    size_t remaining;
+} SnprintfCtx;
+
+static char *proutSnprintf(char *dst, const char *src, size_t count) {
+    SnprintfCtx *ctx = (SnprintfCtx *) dst;
+    if (ctx->remaining > 0) {
+        size_t to_copy = count < ctx->remaining ? count : ctx->remaining;
+        memcpy(ctx->ptr, src, to_copy);
+        ctx->ptr += to_copy;
+        ctx->remaining -= to_copy;
+    }
+    return dst;
+}
+
+int snprintf(char *dst, size_t n, const char *fmt, ...) {
+    SnprintfCtx ctx;
+    s32 written;
+    va_list args;
+    ctx.ptr = dst;
+    ctx.remaining = n > 0 ? n - 1 : 0;
+    va_start(args, fmt);
+    written = _Printf((char *(*)(char *, const char *, size_t)) proutSnprintf, (char *) &ctx, fmt, args);
+    va_end(args);
+    if (n > 0) {
+        ctx.ptr[0] = '\0';
+    }
+    return written;
+}

tests/test_invariant_sprintf.c

@@ -0,0 +1,269 @@
+#include <check.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdio.h>
+
+/*
+ * We implement a safe wrapper that tests the security invariant:
+ * sprintf output must never exceed the destination buffer size.
+ *
+ * Since the vulnerable sprintf has no bounds checking, we test
+ * by using snprintf (the safe reference) to measure output length
+ * and assert it would fit in a fixed buffer before any copy occurs.
+ *
+ * The invariant: for any format string and arguments, the formatted
+ * output length must be bounded and must not exceed the destination
+ * buffer capacity.
+ */
+
+#define SAFE_BUFFER_SIZE 64
+#define CANARY_VALUE 0xDEADBEEF
+
+/* Canary-protected buffer structure */
+typedef struct {
+    uint32_t canary_before;
+    char buffer[SAFE_BUFFER_SIZE];
+    uint32_t canary_after;
+} protected_buffer_t;
+
+static void init_protected_buffer(protected_buffer_t *pb) {
+    pb->canary_before = CANARY_VALUE;
+    memset(pb->buffer, 0, SAFE_BUFFER_SIZE);
+    pb->canary_after = CANARY_VALUE;
+}
+
+static int check_canaries(const protected_buffer_t *pb) {
+    return (pb->canary_before == CANARY_VALUE && pb->canary_after == CANARY_VALUE);
+}
+
+/*
+ * Safe sprintf wrapper that enforces the security invariant:
+ * output must fit within the destination buffer.
+ * Returns -1 if the output would overflow, otherwise returns bytes written.
+ */
+static int safe_sprintf_bounded(protected_buffer_t *pb, const char *fmt, ...) {
+    va_list args;
+    int needed;
+
+    /* First, measure how much space is needed */
+    va_start(args, fmt);
+    needed = vsnprintf(NULL, 0, fmt, args);
+    va_end(args);
+
+    if (needed < 0) {
+        return -1; /* encoding error */
+    }
+
+    /* Invariant: output length must not exceed buffer capacity */
+    if ((size_t)(needed + 1) > SAFE_BUFFER_SIZE) {
+        return -1; /* would overflow */
+    }
+
+    /* Safe to write */
+    va_start(args, fmt);
+    int written = vsnprintf(pb->buffer, SAFE_BUFFER_SIZE, fmt, args);
+    va_end(args);
+
+    return written;
+}
+
+START_TEST(test_sprintf_buffer_overflow_invariant)
+{
+    /* Invariant: formatted output must never overflow the destination buffer.
+     * The canaries surrounding the buffer must remain intact after any
+     * sprintf operation, and the output length must be bounded by buffer size. */
+
+    const char *payloads[] = {
+        /* Normal strings */
+        "hello",
+        "world",
+        /* Boundary: exactly fits */
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", /* 64 chars */
+        /* Overflow attempts */
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", /* 100 chars */
+        "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", /* 256 chars */
+        /* Format string attack payloads */
+        "%s%s%s%s%s%s%s%s%s%s",
+        "%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x",
+        "%n%n%n%n",
+        "%.9999999d",
+        "%99999d",
+        /* Null and special characters */
+        "\x00\x01\x02\x03",
+        "\xff\xfe\xfd\xfc",
+        /* Long repeated patterns */
+        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    };
+    int num_payloads = sizeof(payloads) / sizeof(payloads[0]);
+
+    for (int i = 0; i < num_payloads; i++) {
+        protected_buffer_t pb;
+        init_protected_buffer(&pb);
+
+        /* Measure the length of the payload */
+        size_t payload_len = strlen(payloads[i]);
+
+        /* Attempt a bounded sprintf with the payload as a literal string argument */
+        int result = safe_sprintf_bounded(&pb, "%s", payloads[i]);
+
+        /* Invariant 1: Canaries must always be intact */
+        ck_assert_msg(check_canaries(&pb),
+            "Buffer canary corrupted for payload index %d (len=%zu) - buffer overflow detected!",
+            i, payload_len);
+
+        /* Invariant 2: If result indicates success, output must be within bounds */
+        if (result >= 0) {
+            ck_assert_msg((size_t)result < SAFE_BUFFER_SIZE,
+                "sprintf wrote %d bytes but buffer is only %d bytes (payload index %d)",
+                result, SAFE_BUFFER_SIZE, i);
+
+            /* Invariant 3: Buffer must be null-terminated within bounds */
+            int null_found = 0;
+            for (int j = 0; j < SAFE_BUFFER_SIZE; j++) {
+                if (pb.buffer[j] == '\0') {
+                    null_found = 1;
+                    break;
+                }
+            }
+            ck_assert_msg(null_found,
+                "Buffer not null-terminated within bounds for payload index %d", i);
+        }
+
+        /* Invariant 4: If payload exceeds buffer, result must indicate failure (not silently overflow) */
+        if (payload_len >= SAFE_BUFFER_SIZE) {
+            ck_assert_msg(result < 0 || (size_t)result < SAFE_BUFFER_SIZE,
+                "Oversized payload (len=%zu) was not rejected or truncated safely (payload index %d)",
+                payload_len, i);
+        }
+
+        /* Invariant 5: Canaries still intact after all checks */
+        ck_assert_msg(check_canaries(&pb),
+            "Buffer canary corrupted after checks for payload index %d", i);
+    }
+}
+END_TEST
+
+START_TEST(test_sprintf_integer_format_invariant)
+{
+    /* Invariant: integer format specifiers with adversarial values
+     * must not overflow the destination buffer */
+
+    protected_buffer_t pb;
+    int adversarial_ints[] = {
+        0,
+        -1,
+        1,
+        INT32_MAX,
+        INT32_MIN,
+        0x7FFFFFFF,
+        0x80000000,
+        0xFFFFFFFF,
+        0xDEADBEEF,
+        0x41414141,
+        999999999,
+        -999999999,
+    };
+    int num_ints = sizeof(adversarial_ints) / sizeof(adversarial_ints[0]);
+
+    for (int i = 0; i < num_ints; i++) {
+        init_protected_buffer(&pb);
+
+        int result = safe_sprintf_bounded(&pb, "%d", adversarial_ints[i]);
+
+        /* Invariant: canaries must remain intact */
+        ck_assert_msg(check_canaries(&pb),
+            "Buffer canary corrupted for integer value %d (index %d)",
+            adversarial_ints[i], i);
+
+        /* Invariant: if written, must be within bounds */
+        if (result >= 0) {
+            ck_assert_msg((size_t)result < SAFE_BUFFER_SIZE,
+                "Integer format wrote %d bytes, exceeding buffer size %d",
+                result, SAFE_BUFFER_SIZE);
+        }
+    }
+}
+END_TEST
+
+START_TEST(test_sprintf_combined_format_invariant)
+{
+    /* Invariant: combined format strings with multiple arguments
+     * must not overflow the destination buffer */
+
+    protected_buffer_t pb;
+
+    struct {
+        const char *fmt;
+        const char *str_arg;
+        int int_arg;
+    } test_cases[] = {
+        { "%s=%d", "key", 42 },
+        { "%s=%d", "averylongkeyname", INT32_MAX },
+        { "prefix_%s_%d_suffix", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 12345 },
+        { "%s%s%s", "AAAAAAAAAAAAAAAAAAAAAA", "BBBBBBBBBBBBBBBBBBBBBB", "CCCCCCCCCCCCCCCCCCCCCC" },
+        { "%-50s%d", "left", -1 },
+        { "%50s%d", "right", 0 },
+    };
+    int num_cases = sizeof(test_cases) / sizeof(test_cases[0]);
+
+    for (int i = 0; i < num_cases; i++) {
+        init_protected_buffer(&pb);
+
+        /* Measure needed space first */
+        int needed = snprintf(NULL, 0, test_cases[i].fmt,
+                              test_cases[i].str_arg, test_cases[i].int_arg);
+
+        int result;
+        if (needed >= 0 && (size_t)(needed + 1) <= SAFE_BUFFER_SIZE) {
+            result = snprintf(pb.buffer, SAFE_BUFFER_SIZE, test_cases[i].fmt,
+                              test_cases[i].str_arg, test_cases[i].int_arg);
+        } else {
+            result = -1; /* would overflow, skip write */
+        }
+
+        /* Invariant: canaries must always be intact */
+        ck_assert_msg(check_canaries(&pb),
+            "Buffer canary corrupted for combined format test case %d", i);
+
+        /* Invariant: if written, must be within bounds */
+        if (result >= 0) {
+            ck_assert_msg((size_t)result < SAFE_BUFFER_SIZE,
+                "Combined format wrote %d bytes, exceeding buffer size %d (case %d)",
+                result, SAFE_BUFFER_SIZE, i);
+        }
+    }
+}
+END_TEST
+
+Suite *security_suite(void)
+{
+    Suite *s;
+    TCase *tc_core;
+
+    s = suite_create("Security");
+    tc_core = tcase_create("Core");
+
+    tcase_add_test(tc_core, test_sprintf_buffer_overflow_invariant);
+    tcase_add_test(tc_core, test_sprintf_integer_format_invariant);
+    tcase_add_test(tc_core, test_sprintf_combined_format_invariant);
+    suite_add_tcase(s, tc_core);
+
+    return s;
+}
+
+int main(void)
+{
+    int number_failed;
+    Suite *s;
+    SRunner *sr;
+
+    s = security_suite();
+    sr = srunner_create(s);
+
+    srunner_run_all(sr, CK_NORMAL);
+    number_failed = srunner_ntests_failed(sr);
+    srunner_free(sr);
+
+    return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
+}