quoted from http://liw.iki.fi/liw/texts/longest-living-bug.html
In the spring and summer of 1991, my friend Linus was playing around with this OS-like program, which later became Linux. He wanted a printf like service inside the kernel, but didn’t know how to implement it, though (he didn’t know C thoroughly back then). So I wrote him an sprintf clone, and he used that, after some modifications.
In September of 1994, Friedemann Baitinger at IBM, who was developing a device driver for another operating system, used my sprintf clone as a debugging aid (but not in the final product). The bug lived for three or three and a half years before anyone found it. Worse, the bug was immediately obvious as soon as one tried to use the function in a certain, common way. No-one had done that, ever, not even I when I wrote it. Don’t ever hire me to write code that is expected to work.
The bug was in the handling of a field width given via the argument list. With sprintf, to print a string, for example, you would write
sprintf(buf, "%s", str);
This would put the str' string intobuf’. sprintf allows formatting of the output:
sprintf(buf, "%10s", str);
This would make the output string at least 10 characters wide (wider, if `str’ is wider). The field width can be a constant, or it can be given as a separate argument:
sprintf(buf, "%*s", 10, str);
This gives the same output as before, but triggered my bug.
My sprintf was implemented with a loop that walked through the format string and incremented an index when it processed various parts of the format string. Except that when it processed the `*’, it didn’t increment. Oops.
So why do I explain this so thoroughly? My weird sense of humor made me put “Author of the longest-living Linux bug” in the CREDITS file in the kernel sources, and people sometimes ask me about it. I figured I’d answer it once, and point people at this web page.