The following piece of test code... ATF_TC(snprintf_posarg_error); ATF_TC_HEAD(snprintf_posarg_error, tc) { atf_tc_set_md_var(tc, "descr", "test for positional arguments out " "of bounds"); } ATF_TC_BODY(snprintf_posarg_error, tc) { char s[16], fmt[32]; snprintf(fmt, sizeof(fmt), "%%%zu$d", SIZE_MAX / sizeof(size_t)); ATF_CHECK(snprintf(s, sizeof(s), fmt, -23) == -1); } Produces this segfault: tc-start: 1376007948.899132, snprintf_posarg_error tc-se:Test program crashed; attempting to get stack trace tc-se:Core was generated by `t_printf'. tc-se:Program terminated with signal 11, Segmentation fault. tc-se:#0 0x28186bc3 in vfprintf () from /lib/libc.so.7 tc-se:Stack trace complete tc-end: 1376007948.947316, snprintf_posarg_error, failed, Test program received signal 11 (core dumped)
For bugs matching the following criteria: Status: In Progress Changed: (is less than) 2014-06-01 Reset to default assignee and clear in-progress tags. Mail being skipped