Commit a6d8d74310 for openssl.org

commit a6d8d74310eb4e3e3a18faf6391c07ede2f8e2e0
Author: Bob Beck <beck@openssl.org>
Date:   Wed Jun 17 19:33:07 2026 -0600

    Convert BIO_snprintf() in BN_bn2dec() to snprintf() and guard each advance.

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Wed Aug 26 16:20:17 2026
    (Merged from https://github.com/openssl/openssl/pull/31640)

diff --git a/crypto/bn/bn_conv.c b/crypto/bn/bn_conv.c
index f295e5db9a..71a5672788 100644
--- a/crypto/bn/bn_conv.c
+++ b/crypto/bn/bn_conv.c
@@ -7,6 +7,8 @@
  * https://www.openssl.org/source/license.html
  */

+#include <stdio.h>
+
 #include <openssl/err.h>
 #include "crypto/ctype.h"
 #include "bn_local.h"
@@ -93,14 +95,14 @@ char *BN_bn2dec(const BIGNUM *a)
          * the last one needs truncation. The blocks need to be reversed in
          * order.
          */
-        n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
-        if (n < 0)
+        n = snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
+        if (n < 0 || (size_t)n >= tbytes - (size_t)(p - buf))
             goto err;
         p += n;
         while (lp != bn_data) {
             lp--;
-            n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);
-            if (n < 0)
+            n = snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);
+            if (n < 0 || (size_t)n >= tbytes - (size_t)(p - buf))
                 goto err;
             p += n;
         }