[Bug libstdc++/110862] New: format out of bands read on format string "{0:{0}"

[Bug libstdc++/110862] New: format out of bands read on format string "{0:{0}"

[gcc at pauldreik dot se]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

            Bug ID: 110862
           Summary: format out of bands read on format string "{0:{0}"
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gcc at pauldreik dot se
  Target Milestone: ---

The following program with an incorrect format string causes an out of bounds
read when compiled with gcc 13.2:

#include <cstdio>
#include <format>

int main() {
    unsigned short v = 0;
    std::puts(std::vformat("{0:{0}", std::make_format_args(v)).c_str());
}

I expected an exception to be thrown.

Link to reproducer: 
https://godbolt.org/z/WrqxGE1jG

[Bug libstdc++/110862] format out of bands read on format string "{0:{0}"

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

康桓瑋 <hewillk at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hewillk at gmail dot com

--- Comment #1 from 康桓瑋 <hewillk at gmail dot com> ---
It does throw:

https://godbolt.org/z/5q3bb51YE

[Bug libstdc++/110862] format out of bands read on format string "{0:{0}"

[gcc at pauldreik dot se]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

--- Comment #2 from Paul Dreik <gcc at pauldreik dot se> ---
(In reply to 康桓瑋 from comment #1)
> It does throw:
> 
> https://godbolt.org/z/5q3bb51YE

Sorry for being unclear. Yes, it throws but that is after the out of bounds
read has happened.

[Bug libstdc++/110862] format out of bands read on format string "{0:{0}"

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3
   Last reconfirmed|                            |2023-08-01
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED

[Bug libstdc++/110862] format out of bounds read on format string "{0:{0}"

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
https://gcc.gnu.org/git?p=gcc.git;a=blob;f=libstdc%2B%2B-v3/include/std/format;h=9d5981e4882991cc2cbfb9353d399372030e8722;hb=refs/heads/master#l3535
needs to throw if begin()==end() || *begin() != '}'

Fix incoming as soon as I have a decent WiFi signal.

[Bug libstdc++/110862] format out of bounds read on format string "{0:{0}"

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:5d87f71bb462ccb78dd3d9d810ea08d96869cb4b

commit r14-3066-g5d87f71bb462ccb78dd3d9d810ea08d96869cb4b
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Thu Aug 3 08:45:43 2023 +0100

    libstdc++: Fix past-the-end increment in std::format [PR110862]

    At the end of a replacement field we should check that the closing brace
    is actually present before incrementing past it.

    libstdc++-v3/ChangeLog:

            PR libstdc++/110862
            * include/std/format (_Scanner::_M_on_replacement_field):
            Check for expected '}' before incrementing iterator.
            * testsuite/std/format/string.cc: Check "{0:{0}" format string.

[Bug libstdc++/110862] format out of bounds read on format string "{0:{0}"

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:55eb7e92a60adfae43aaf58bb9c81050d39d82c9

commit r13-7697-g55eb7e92a60adfae43aaf58bb9c81050d39d82c9
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Thu Aug 3 08:45:43 2023 +0100

    libstdc++: Fix past-the-end increment in std::format [PR110862]

    At the end of a replacement field we should check that the closing brace
    is actually present before incrementing past it.

    libstdc++-v3/ChangeLog:

            PR libstdc++/110862
            * include/std/format (_Scanner::_M_on_replacement_field):
            Check for expected '}' before incrementing iterator.
            * testsuite/std/format/string.cc: Check "{0:{0}" format string.

    (cherry picked from commit 5d87f71bb462ccb78dd3d9d810ea08d96869cb4b)

[Bug libstdc++/110862] format out of bounds read on format string "{0:{0}"

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110862

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Fixed for 13.3, thanks for the report.