👀 Views: 382 💬 Answers: 1 📅 Created: 2025-08-21

c sprintf buffer-overflow C

I've searched everywhere and can't find a clear answer. I'm working with a puzzling scenario when using `sprintf` to format strings into a large buffer on a 64-bit system. The buffer is allocated with a size of 10,000 bytes, and I'm trying to format various strings into it. However, I occasionally get unexpected output, including missing characters and even corrupted data in the resulting string. Here's a simplified version of my code: ```c #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { char *buffer = (char *)malloc(10000); if (buffer == NULL) { perror("Failed to allocate memory"); return 1; } memset(buffer, 0, 10000); int result = sprintf(buffer, "This is a test: %s", "hello world"); if (result < 0) { perror("sprintf failed"); } printf("Buffer contents: %s\n", buffer); // Simulating more sprintf calls for (int i = 0; i < 100; i++) { sprintf(buffer + strlen(buffer), " %d", i); } printf("Buffer after loop: %s\n", buffer); free(buffer); return 0; } ``` When I run this code, the output after the loop sometimes shows random characters or omits numbers. I've checked that I'm not writing past the buffer size, so I don't think that's the scenario. The output is often fine for the first few runs but becomes inconsistent after several iterations. I've tried using `snprintf` instead to limit the buffer writes, but that didn't help with the erratic behavior. I've also verified that the memory allocation succeeds and the buffer is initialized to zero. The compiler I'm using is GCC 12.1 on a 64-bit Linux machine. Is there something specific about how `sprintf` handles large buffers or concurrent writes that I'm missing? Any insights would be greatly appreciated! What am I doing wrong?