From 5a02fa04d9abedaa537e08965eca59ea73b96504 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= <tobias@wolfssl.com>
Date: Wed, 30 Sep 2026 10:05:25 +0200
Subject: [PATCH] Bound error-message and time-string formatting under WOLF_C89

Under WOLF_C89, XSNPRINTF is sprintf and ignores the size argument.
WOLFSSL_ERROR_LINE formatted the source file name into an 80-byte
buffer and wolfSSL_ERR_print_errors formatted the reason and file into
a 160-byte one, so long __FILE__ paths, as CMake builds produce,
overflowed the stack. GetTimeString wrote its 24-character string
regardless of the length wolfSSL_ASN1_TIME_to_string was given.

Bound the file name and reason with a precision, and format the time
into a local buffer and copy it only when it fits the caller's length.
---
 src/ssl_err.c           |  7 ++++---
 wolfcrypt/src/asn.c     | 10 ++++++----
 wolfcrypt/src/logging.c | 11 ++++++++---
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/src/ssl_err.c b/src/ssl_err.c
index 27100bf7c7..78bcbb620b 100644
--- a/src/ssl_err.c
+++ b/src/ssl_err.c
@@ -149,7 +149,7 @@ void wolfSSL_ERR_print_errors_cb (int (*cb)(const char *str, size_t len,
         const char* reason = NULL;
         int ret;
         int line = 0;
-        char buf[WOLFSSL_MAX_ERROR_SZ * 2];
+        char buf[WOLFSSL_MAX_ERROR_SZ * 2 + 64];
 
         WOLFSSL_ENTER("wolfSSL_ERR_print_errors");
 
@@ -164,8 +164,9 @@ void wolfSSL_ERR_print_errors_cb (int (*cb)(const char *str, size_t len,
             const char* r = wolfSSL_ERR_reason_error_string(
                 (unsigned long)(0 - ret));
             if (XSNPRINTF(buf, sizeof(buf),
-                          "error:%d:wolfSSL library:%s:%s:%d\n",
-                          ret, r, file, line)
+                          "error:%d:wolfSSL library:%.*s:%.*s:%d\n",
+                          ret, WOLFSSL_MAX_ERROR_SZ - 1, r,
+                          WOLFSSL_MAX_ERROR_SZ - 1, file, line)
                 >= (int)sizeof(buf))
             {
                 WOLFSSL_MSG("Buffer overrun formatting error message");
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index d700563633..6f41b8f1dd 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -16299,6 +16299,8 @@ int GetTimeString(byte* date, int format, char* buf, int len, int dateLen)
 {
     struct tm t;
     int idx = 0;
+    char tmp[64];
+    int tmpLen;
 
     if (!ExtractDate(date, (unsigned char)format, &t, &idx, dateLen)) {
         return 0;
@@ -16330,13 +16332,13 @@ int GetTimeString(byte* date, int format, char* buf, int len, int dateLen)
     }
     idx = 4; /* use idx now for char buffer */
 
-    if (XSNPRINTF(buf + idx, (size_t)(len - idx), "%2d %02d:%02d:%02d %d GMT",
-              t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, (int)t.tm_year + 1900)
-        >= len - idx)
-    {
+    tmpLen = XSNPRINTF(tmp, sizeof(tmp), "%2d %02d:%02d:%02d %d GMT",
+              t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, (int)t.tm_year + 1900);
+    if ((tmpLen < 0) || (tmpLen >= len - idx)) {
         WOLFSSL_MSG("buffer overrun in GetTimeString");
         return 0;
     }
+    XMEMCPY(buf + idx, tmp, (size_t)tmpLen + 1);
 
     return 1;
 }
diff --git a/wolfcrypt/src/logging.c b/wolfcrypt/src/logging.c
index 736adbebdb..5eea03c07d 100644
--- a/wolfcrypt/src/logging.c
+++ b/wolfcrypt/src/logging.c
@@ -1775,6 +1775,7 @@ void WOLFSSL_ERROR(int error)
                     "wolfSSL error occurred, error = %d", error);
         }
         else {
+            int len;
             #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY)
             /* If running in compatibility mode do not add want read and
                want right to error queue */
@@ -1783,9 +1784,13 @@ void WOLFSSL_ERROR(int error)
             #endif
             if (error < 0)
                 error = error - (2 * error); /* get absolute value */
-            (void)XSNPRINTF(buffer, sizeof(buffer),
-                    "wolfSSL error occurred, error = %d line:%u file:%s",
-                    error, line, file);
+            len = XSNPRINTF(buffer, sizeof(buffer),
+                    "wolfSSL error occurred, error = %d line:%u file:",
+                    error, line);
+            if ((len > 0) && (len < (int)sizeof(buffer))) {
+                (void)XSNPRINTF(buffer + len, sizeof(buffer) - (size_t)len,
+                        "%.*s", (int)sizeof(buffer) - 1 - len, file);
+            }
 
             if (wc_AddErrorNode(error, (int)line, buffer, (char*)file) != 0) {
                 WOLFSSL_MSG("Error creating logging node");