Convert BIO_snprintf() callers that detect truncation to snprintf().

These sites used the return value to detect truncation, then used the
buffer as is. Convert them to detect truncation in the standard
snprintf() way.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Wed Aug 26 16:20:13 2026
(Merged from https://github.com/openssl/openssl/pull/31640)

3 files changed, 16 insertions, 12 deletions

diff --git a/apps/s_client.c b/apps/s_client.c
index f5aecec1325..9207230cec3 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -172,8 +172,8 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
     /*
      * lookup PSK identity and PSK key based on the given identity hint here
      */
-    ret = BIO_snprintf(identity, max_identity_len, "%s", psk_identity);
-    if (ret < 0 || (unsigned int)ret > max_identity_len)
+    ret = snprintf(identity, max_identity_len, "%s", psk_identity);
+    if (ret < 0 || (unsigned int)ret >= max_identity_len)
         goto out_err;
     if (c_debug)
         BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity,
diff --git a/apps/s_server.c b/apps/s_server.c
index 2856a1b9f59..50926e43774 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -1623,17 +1623,18 @@ static int ech_load_dir(SSL_CTX *lctx, const char *thedir,
         int r;
 
 #ifdef OPENSSL_SYS_VMS
-        r = BIO_snprintf(filepath, sizeof(filepath), "%s%s", thedir, thisfile);
+        r = snprintf(filepath, sizeof(filepath), "%s%s", thedir, thisfile);
 #else
-        r = BIO_snprintf(filepath, sizeof(filepath), "%s/%s", thedir, thisfile);
+        r = snprintf(filepath, sizeof(filepath), "%s/%s", thedir, thisfile);
 #endif
+        if (r < 0 || (size_t)r >= sizeof(filepath))
+            continue;
         if (app_isdir(filepath) > 0) {
             if (s_debug)
                 BIO_printf(bio_err, "Skipping directory: %s\n", filepath);
             continue;
         }
-        if (r < 0
-            || (in = BIO_new_file(filepath, "r")) == NULL
+        if ((in = BIO_new_file(filepath, "r")) == NULL
             || OSSL_ECHSTORE_read_pem(es, in, for_retry) != 1) {
             BIO_printf(bio_err, "Failed reading from: %s\n", filepath);
             continue;
diff --git a/apps/s_time.c b/apps/s_time.c
index d68418445cd..9a2a967f5e3 100644
--- a/apps/s_time.c
+++ b/apps/s_time.c
@@ -307,9 +307,10 @@ int s_time_main(int argc, char **argv)
             goto end;
 
         if (www_path != NULL) {
-            buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd,
+            buf_len = snprintf(buf, sizeof(buf), fmt_http_get_cmd,
                 www_path);
-            if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
+            if (buf_len <= 0 || (size_t)buf_len >= sizeof(buf)
+                || SSL_write(scon, buf, buf_len) <= 0)
                 goto end;
             while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
                 bytes_read += i;
@@ -360,8 +361,9 @@ next:
     }
 
     if (www_path != NULL) {
-        buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd, www_path);
-        if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
+        buf_len = snprintf(buf, sizeof(buf), fmt_http_get_cmd, www_path);
+        if (buf_len <= 0 || (size_t)buf_len >= sizeof(buf)
+            || SSL_write(scon, buf, buf_len) <= 0)
             goto end;
         while (SSL_read(scon, buf, sizeof(buf)) > 0)
             continue;
@@ -388,9 +390,10 @@ next:
             goto end;
 
         if (www_path != NULL) {
-            buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd,
+            buf_len = snprintf(buf, sizeof(buf), fmt_http_get_cmd,
                 www_path);
-            if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
+            if (buf_len <= 0 || (size_t)buf_len >= sizeof(buf)
+                || SSL_write(scon, buf, buf_len) <= 0)
                 goto end;
             while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
                 bytes_read += i;