This is what strnlen(3) is for, let's use it... Alternately, we could unify things like:
len = prec >= 0 ? strnlen(cp, prec) : strlen(cp); if (len > INT_MAX) goto overflow; size = (int)len; but that means declaring "size_t len" at the top of the for(;;) loop. - todd Index: lib/libc/stdio/vfprintf.c =================================================================== RCS file: /cvs/src/lib/libc/stdio/vfprintf.c,v retrieving revision 1.75 diff -u -p -u -r1.75 vfprintf.c --- lib/libc/stdio/vfprintf.c 17 Aug 2016 22:15:08 -0000 1.75 +++ lib/libc/stdio/vfprintf.c 25 Aug 2016 18:12:42 -0000 @@ -887,14 +887,11 @@ fp_common: cp = "(null)"; } if (prec >= 0) { - /* - * can't use strlen; can only look for the - * NUL in the first `prec' characters, and - * strlen() will go further. - */ - char *p = memchr(cp, 0, prec); + size_t len; - size = p ? (p - cp) : prec; + if ((len = strnlen(cp, prec)) > INT_MAX) + goto overflow; + size = (int)len; } else { size_t len;