OS X上的vsprintf：EXC_BAD_ACCESS

Question

I've discovered weird behavior of vsprintf on OSX.

This is my code:

#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#if defined(WIN32)
#include <windows.h>
#define VSNPRINTF _vsnprintf
#elif defined(LINUX) || defined (DARWIN)
#define VSNPRINTF vsnprintf
#include <sys/types.h>
#include <unistd.h>
#endif

char *f(const char *fmt, ...)
{
 char *out = NULL;
 const int step = 32;
 int n = -1, lout = step;
 va_list arg;

 if(fmt!=NULL)
 {
  va_start(arg, fmt);
  do
  {
   if(!out)
   {
    free(out);
    out = NULL;
   }
   out = (char*)malloc(lout + 1);
   if(!out) break;
   memset(out, 0, lout + 1);   

   n = VSNPRINTF(out, lout, fmt, arg);
   if(n == -1 || n + 1 > lout)
   {
    lout += step;
    n = -1;
   }
  }while(n == -1);
  va_end(arg);
 }

 return out;
}

int main()
{
 char *msg = NULL;
 unsigned long x = 0xDEADBEEF;

 msg = f("%X%X%X%X", x, x, x, x);
 if(!msg) return -1;

 puts(msg);

 return 0;
}

The function shall return allocated string (char*) containing formatted text. It works correctly on Linux and Windows. It returns badly formatted text on OSX and sometimes it leads to Segmentation fault (EXC_BAD_ACCESS). Btw, I know that I can use vasprintf.

What can be the problem?

Answer 1

Your problem is most likely that you're calling vsnprintf with the same va_list multiple times. This doesn't work in some ABIs.

Look up the man page of va_copy. The short version is to do something like this:

      va_list c;
      va_copy(c, arg);

      n = VSNPRINTF(out, lout, fmt, c);
      va_end(c);