From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 32644 invoked by alias); 9 Aug 2012 07:50:23 -0000 Received: (qmail 32624 invoked by uid 22791); 9 Aug 2012 07:50:21 -0000 X-SWARE-Spam-Status: No, hits=-2.7 required=5.0 tests=AWL,BAYES_00,KHOP_THREADED,TW_VF X-Spam-Check-By: sourceware.org Received: from hagrid.ecoscentric.com (HELO mail.ecoscentric.com) (212.13.207.197) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 09 Aug 2012 07:50:08 +0000 Received: from localhost (hagrid.ecoscentric.com [127.0.0.1]) by mail.ecoscentric.com (Postfix) with ESMTP id 38A4E2F78005 for ; Thu, 9 Aug 2012 08:50:07 +0100 (BST) Received: from mail.ecoscentric.com ([127.0.0.1]) by localhost (hagrid.ecoscentric.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GqpbBwul0bto; Thu, 9 Aug 2012 08:50:03 +0100 (BST) From: bugzilla-daemon@bugs.ecos.sourceware.org To: ecos-patches@ecos.sourceware.org Subject: [Bug 1001490] C99 snprintf() does not include terminated null in truncated strings X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: eCos X-Bugzilla-Component: Patches and contributions X-Bugzilla-Keywords: X-Bugzilla-Severity: enhancement X-Bugzilla-Who: bernd.edlinger@hotmail.de X-Bugzilla-Status: NEW X-Bugzilla-Priority: low X-Bugzilla-Assigned-To: unassigned@bugs.ecos.sourceware.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Changed-Fields: In-Reply-To: References: X-Bugzilla-URL: http://bugs.ecos.sourceware.org/ Auto-Submitted: auto-generated Content-Type: text/plain; charset="UTF-8" MIME-Version: 1.0 Date: Thu, 09 Aug 2012 07:50:00 -0000 Message-Id: <20120809075002.DF9242F78007@mail.ecoscentric.com> Mailing-List: contact ecos-patches-help@ecos.sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: ecos-patches-owner@ecos.sourceware.org X-SW-Source: 2012-08/txt/msg00023.txt.bz2 Please do not reply to this email. Use the web interface provided at: http://bugs.ecos.sourceware.org/show_bug.cgi?id=1001490 --- Comment #6 from Bernd Edlinger 2012-08-09 08:49:57 BST --- (In reply to comment #5) > It's okay for ("%.18f\n", 3.14e-11) > 0.000000000031400000 but not quite OK for these: ("%.18f\n", 3.1415926E-11) eCos: "0.000000000031400000" glib: "0.000000000031415926" ("%.18f\n", DBL_MAX*2) eCos: "inf000" glib: "inf" > But the padding/zeroing will be wrong for %e, %E, when requested prec > > MAXPREC. but also for %g: this does work like %e, when the value is >=10^prec or <=10^-4 > Well, it looks like my fix (Suzuki did talk about the same point which I > found in GDB), but my workaround was > if (prec > MAXFRACT) { > if ((ch == 'f' && ch == 'F') || (flags&ALT)) { > fpprec = prec - MAXFRACT; > prec = MAXFRACT; > } > } else if (prec == -1) ok, but with this patch there will be a crash in printf("%.999e", x) limiting prec MAXFRACT helps to avoid the buffer overrun in "cvt" however with DBL_MAX the buffer size BUF 2 characters too small as I said. I tried to solve it this way: diff -Nur ecos-cvs-120723/packages/language/c/libc/stdio/current/src/output/vfnprintf.cxx ecos/packages/language/c/libc/stdio/current/src/output/vfnprintf.cxx --- ecos-cvs-120723/packages/language/c/libc/stdio/current/src/output/vfnprintf.cxx 2009-08-20 18:09:18.000000000 +0200 +++ ecos/packages/language/c/libc/stdio/current/src/output/vfnprintf.cxx 2012-08-07 10:16:48.809576300 +0200 @@ -107,7 +107,7 @@ # define MAXFRACT DBL_DIG # define MAXEXP DBL_MAX_10_EXP -# define BUF (MAXEXP+MAXFRACT+1) /* + decimal point */ +# define BUF (MAXEXP+MAXFRACT+3) /* + decimal point + rounding */ # define DEFPREC 6 static int @@ -420,7 +420,7 @@ * zeroes later, so buffer size stays rational. */ if (prec > MAXFRACT) { - if ((ch != 'g' && ch != 'G') || (flags&ALT)) + if (ch == 'f' || ch == 'F') fpprec = prec - MAXFRACT; prec = MAXFRACT; } else if (prec == -1) This way there are no buffer overruns, and the added zeros are at least never in the exponent. That would at least be a interim solution... But I start to think that the "cvt" function will need a complete re-write for strict conformance. And another point would be, that when you look at the vfnprintf function in the assembler (ARM9, eCosCentric GNU tools 4.3.2-sw) vfnprintf:stmdb r13!,{r4-r11,r14} sub r13,r13,#0x30C This function needs 816 bytes on the stack, even if you do not use any %f formats! Maybe reducing this number could be worth the effort. Bernd. -- Configure bugmail: http://bugs.ecos.sourceware.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.