[Bug libstdc++/14975] New: Segfault on low-level write error during imbue

[Bug libstdc++/14975] New: Segfault on low-level write error during imbue

[peturr02 at ru dot is]

This bit from basic_filebuf::imbue in include/bits/fstream.tcc can't
possibly be correct:

              else if (_M_writing && (__testvalid = _M_terminate_output()))
                _M_set_buffer(-1);
            }
        }

      if (__testvalid)
        _M_codecvt = _M_codecvt_tmp;

If __testvalid is false for some reason (for example because
_M_terminate_output returned false because of a low-level write error),
then _M_codecvt will still point to the codecvt facet from the old locale.

Since no reference is kept to the old locale, the facet may be deleted at
any time, and so keeping a pointer to it is certainly wrong.

-- 
           Summary: Segfault on low-level write error during imbue
           Product: gcc
           Version: 3.4.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libstdc++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: peturr02 at ru dot is
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] Segfault on low-level write error during imbue

[peturr02 at ru dot is]

------- Additional Comments From peturr02 at ru dot is  2004-04-16 13:44 -------
Created an attachment (id=6094)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=6094&action=view)
Test case

This test case shows a segfault after a low-level write error.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] Segfault on low-level write error during imbue

[peturr02 at ru dot is]

------- Additional Comments From peturr02 at ru dot is  2004-04-16 13:45 -------
Created an attachment (id=6095)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=6095&action=view)
Test case

This test case shows a segfault when an overridden version of
overflow returns eof().


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] Segfault on low-level write error during imbue

[pcarlini at suse dot de]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 772 bytes --]


------- Additional Comments From pcarlini at suse dot de  2004-04-16 14:03 -------
Hi Pétur, thanks for the testcases. Indeed, while working on 12077 I had noticed
that something was wrong... but had hoped nobody would notice ;)

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |pcarlini at suse dot de
                   |dot org                     |
             Status|UNCONFIRMED                 |ASSIGNED
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2004-04-16 14:03:43
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] Segfault on low-level write error during imbue

[pcarlini at suse dot de]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |3.4.1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] Segfault on low-level write error during imbue

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-04-16 16:06 -------
Subject: Bug 14975

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	paolo@gcc.gnu.org	2004-04-16 16:06:22

Modified files:
	libstdc++-v3   : ChangeLog 
	libstdc++-v3/include/bits: fstream.tcc 
Added files:
	libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/char: 
	                                                       14975-1.cc 
	libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/wchar_t: 
	                                                          14975-2.cc 

Log message:
	2004-04-16  Paolo Carlini  <pcarlini@suse.de>
	
	PR libstdc++/14975
	* include/bits/fstream.tcc (basic_filebuf::imbue): Zero _M_codecvt
	in case of error.
	* testsuite/27_io/basic_filebuf/imbue/char/14975-1.cc: New.
	* testsuite/27_io/basic_filebuf/imbue/wchar_t/14975-2.cc: New.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/ChangeLog.diff?cvsroot=gcc&r1=1.2449&r2=1.2450
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/include/bits/fstream.tcc.diff?cvsroot=gcc&r1=1.120&r2=1.121
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/char/14975-1.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/wchar_t/14975-2.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] [3.4 only] Segfault on low-level write error during imbue

[peturr02 at ru dot is]

------- Additional Comments From peturr02 at ru dot is  2004-04-17 14:49 -------
       if (__testvalid)
 	_M_codecvt = _M_codecvt_tmp;
+      else
+	_M_codecvt = 0;
     }

It would probably also be a good idea to somehow signal the error in
overflow (for example by throwing an exception).


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] [3.4 only] Segfault on low-level write error during imbue

[pcarlini at suse dot de]

------- Additional Comments From pcarlini at suse dot de  2004-04-17 22:11 -------
Ok, thanks, I will look into this.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] [3.4 only] Segfault on low-level write error during imbue

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-04-29 10:26 -------
Subject: Bug 14975

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-3_4-branch
Changes by:	paolo@gcc.gnu.org	2004-04-29 10:26:44

Modified files:
	libstdc++-v3   : ChangeLog 
	libstdc++-v3/include/bits: fstream.tcc 
Added files:
	libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/char: 
	                                                       14975-1.cc 
	libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/wchar_t: 
	                                                          14975-2.cc 

Log message:
	2004-04-29  Paolo Carlini  <pcarlini@suse.de>
	
	PR libstdc++/14975
	* include/bits/fstream.tcc (basic_filebuf::imbue): Zero _M_codecvt
	in case of error.
	* testsuite/27_io/basic_filebuf/imbue/char/14975-1.cc: New.
	* testsuite/27_io/basic_filebuf/imbue/wchar_t/14975-2.cc: New.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.2224.2.87&r2=1.2224.2.88
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/include/bits/fstream.tcc.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.116.4.4&r2=1.116.4.5
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/char/14975-1.cc.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=NONE&r2=1.1.6.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/27_io/basic_filebuf/imbue/wchar_t/14975-2.cc.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=NONE&r2=1.1.6.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975

[Bug libstdc++/14975] [3.4 only] Segfault on low-level write error during imbue

[pcarlini at suse dot de]

------- Additional Comments From pcarlini at suse dot de  2004-04-29 10:27 -------
Fixed for 3.4.1.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975