Printf inconsistency when handed null string

Small correction: vfprintf.c not vprintf.c. Sorry for the typo.

I can confirm this behaviour.

I am not sure that you've correctly identified the cause, though. Looking at the disassembled machine code for both function calls, I found that 'printf("%s\n")' isn't handled by printf() at all -- the compiler inserts a call to puts() instead. puts(), in turn, calls strlen(), passing it a null pointer, which strlen() tries to dereference. Hence, the segmentation fault.

One more thing: Is this actually a bug? I mean, the inconsistency is due to gcc's substituting puts() for printf(). Calling puts() with a null pointer results in a segfault. But isn't it the programmer's job to make sure that he doesn't accidentally pass a null pointer to puts() -- or to printf("%s\n") for that matter?

Anyway, since I can reproduce this, I am marking this as confirmed.

I agree 100% that it is the programmer's responsibility to check for null pointers and found this bug through testing of my own code.

I also played around with it last night and confirm as well that my original guess at the cause of this behavior was incorrect.

The only reason I reported this behavior was because in the latter of the two cases above it doesn't segfault, but in the former does. I think that the behavior should be consistent whether it has the space or not.

gcc optimises printf to puts.
They behave differently, so the optimisation is invalid.

I've been digging through the gcc-4.3 source, looking for where the compiler swaps
printf("%s\n",str);
with
puts(str);

but the source is huge and I have no idea where or how to find the code responsible for this.

I would happily patch this, provided I can get some direction on where I can find the optimization code

I've traced the file that does the optimization to
/usr/src/gcc-4.3/gcc-4.3.3/gcc/builtins.c

The functions are

fold_builtin_printf()
fold_builtin_sprintf()

the functions return a tree that seems to point straight to some puts() or putchar() construct

that return tree should be modified to include a null check

I'm posting this preliminary research in case anyone already knows the gcc tree struct and can easily patch it

I think you need to try to convince the gcc developers that this is a bug.

How can I do that?

On Sun, May 10, 2009 at 3:29 AM, Malcolm Parsons
<email address hidden>wrote:

> I think you need to try to convince the gcc developers that this is a
> bug.
>
> --
> Printf inconsistency when handed null string
> https://bugs.launchpad.net/bugs/193795
> You received this bug notification because you are a direct subscriber
> of the bug.
>

> How can I do that?

You could try posting to their mailing list.

http://gcc.gnu.org/lists.html

the gcc developers responded somewhat prick-like stating that it's the programmer's fault

anyways the interim solution is to pass the "-fno-builtin-printf" to the compiler