From 1be4c6e9cfc6060f77efe1aaa061680f9f23fc83 Mon Sep 17 00:00:00 2001
From: Vincent Sanders <vince@kyllikki.org>
Date: Thu, 24 Oct 2019 13:12:37 +0100
Subject: [PATCH] LibC: Stop stdio from adding null terminators out of bounds
 (#685)

When using the bounded string operations (e.g. snprintf), the null
terminator was always being written even if there was no space for
it (or indeed any valid buffer at all)

This overwriting caused segmentation faults and memory corruption
---
 Libraries/LibC/stdio.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Libraries/LibC/stdio.cpp b/Libraries/LibC/stdio.cpp
index 3da19ac12f..ae9872c877 100644
--- a/Libraries/LibC/stdio.cpp
+++ b/Libraries/LibC/stdio.cpp
@@ -395,7 +395,6 @@ int sprintf(char* buffer, const char* fmt, ...)
     va_list ap;
     va_start(ap, fmt);
     int ret = vsprintf(buffer, fmt, ap);
-    buffer[ret] = '\0';
     va_end(ap);
     return ret;
 }
@@ -413,7 +412,9 @@ int vsnprintf(char* buffer, size_t size, const char* fmt, va_list ap)
 {
     __vsnprintf_space_remaining = size;
     int ret = printf_internal(sized_buffer_putch, buffer, fmt, ap);
-    buffer[ret] = '\0';
+    if (__vsnprintf_space_remaining) {
+	    buffer[ret] = '\0';
+    }
     return ret;
 }
 
@@ -422,7 +423,6 @@ int snprintf(char* buffer, size_t size, const char* fmt, ...)
     va_list ap;
     va_start(ap, fmt);
     int ret = vsnprintf(buffer, size, fmt, ap);
-    buffer[ret] = '\0';
     va_end(ap);
     return ret;
 }