[PATCH] vfprintf stack overflow [BZ #16617]

[Paul Eggert]

On 12/05/2014 12:26 PM, Rich Felker wrote:
> If N is the size of an actual allocated object, 2*N should not be able
> to overflow. If it can, it means you already have a situation where an
> object is so large that legal pointer subtractions overflow ptrdiff_t
No, because the array elements are of type struct printf_spec, which is 
several bytes in size.  So even if the number of bytes in the array 
exceeds PTRDIFF_MAX by a factor of (say) eight, subtracting addresses of 
array elements won't overflow.

Admittedly this is all a bit theoretical.