Negative return value of the _snprintf() function

I am reviewing a legacy C code that calls _snprintf() function and then checks the status it returns to make amends if necessary.

As such, it checks for status == count being passed, which assumes that the count passed did not account for an extra NULL character, in which case the logic that I am reviewing is replacing the last character in the string with NULL.

Also, it checks for status == -1, and in that case creates an empty null-terminated string.

I was curious on which conditions the -1 value is returned, and found the following explanation in https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/snprintf-snprintf-snprintf-l-snwprintf-snwprintf-l?view=msvc-170:

> If len > count, count characters are stored in buffer, no
> null-terminator is appended, and a negative value is returned.

You see, this article says just "negative value", without any distinction specifically for -1. This makes me suspicious if it is possible it can return other negative values (-2, -3, etc.) which seems the documentation implies. So I am curious as to what the specific negative return value means in this case, and most importantly, it looks to me that the existing code is not doing good enough work for testing for abnormal situation, and instead of checking for status == -1, it should be checking for status < 0. So, is there a possibility to get back a negative number other than -1, and if so - what would it mean?

> it looks to me that the existing code is not doing good enough work for testing for abnormal situation, and instead of checking for status == -1, it should be checking for status < 0

Correct.

> So, is there a possibility to get back a negative number other than -1

Yes.

> and if so - what would it mean?

It means there was an error.

Documentation is often vague like that to make sure you don't check for a specific value. The exact value is likely an implementation detail and can change. Since it is not documented, you'd have to dig into the source code or run a bunch of tests to find out, but that would only be valid for that specific version of the function.

Note: do not try to use errno unless it is specifically documented to set it. Lots of things inside the call to _snprintf can incidentally set errno giving you a false error flag.

There is one documented instance where errno is set and there is a specific return value...

> If buffer is a null pointer and count is nonzero, or if format is a null pointer, the invalid parameter handler is invoked, as described in Parameter validation. If execution is allowed to continue, these functions return -1 and set errno to EINVAL.