VULNERABILITY DETAILS
Possible Buffer Overflow [CWE-120]

VERSION
ChromeOs Version: Current Stable
Operating System: Chromeos

REPRODUCTION CASE
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code. 

VULNERABLE CODE
https://chromium.googlesource.com/chromiumos/third_party/u-boot-v1/+/refs/heads/0.15.877.B/examples/api/libgenwrap.c#40

int printf (const char *fmt, ...)
{
	va_list args;
	uint i;
	char printbuffer[256];
	va_start (args, fmt);
	/* For this to work, printbuffer must be larger than
	 * anything we ever want to print.
	 */
	i = vsprintf (printbuffer, fmt, args);
	va_end (args);
	/* Print the string */
	ub_puts (printbuffer);
	return i;
}

Copies data in the buffer without checking the actual size of the buffer.
This might cause a Buffer Overflow which can result in a DoS vulnerability(Crash) or Arbitary Code Execution. 

MITITGATION

Use vsnprintf() instead.
vsnprintf knows how big the buffer that will contain the result is, and it will make sure not to go past that(instead truncating the result to fit within buf ).