public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f)
@ 2023-08-10 8:17 gcc at pauldreik dot se
2023-08-10 9:10 ` [Bug libstdc++/110968] " redi at gcc dot gnu.org
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: gcc at pauldreik dot se @ 2023-08-10 8:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
Bug ID: 110968
Summary: format out of bounds read on format("{:05L}",-1.f)
Product: gcc
Version: 13.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: gcc at pauldreik dot se
Target Milestone: ---
The following program:
#include <cstdio>
#include <format>
int main() {
float v = -1;
std::puts(std::vformat("{:05L}", std::make_format_args(v)).c_str());
}
generates an out of bounds read when compiled with gcc 13.2 (and current trunk,
as of 2023-08-10).
Link to reproducer: https://godbolt.org/z/PjeTsK89E
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
@ 2023-08-10 9:10 ` redi at gcc dot gnu.org
2023-08-10 13:18 ` redi at gcc dot gnu.org
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: redi at gcc dot gnu.org @ 2023-08-10 9:10 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Status|UNCONFIRMED |ASSIGNED
Target Milestone|--- |13.3
Last reconfirmed| |2023-08-10
Assignee|unassigned at gcc dot gnu.org |redi at gcc dot gnu.org
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
2023-08-10 9:10 ` [Bug libstdc++/110968] " redi at gcc dot gnu.org
@ 2023-08-10 13:18 ` redi at gcc dot gnu.org
2023-08-10 13:19 ` redi at gcc dot gnu.org
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: redi at gcc dot gnu.org @ 2023-08-10 13:18 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Oh dear, I must have broken this function at some point while implementing
std::format:
// Locale-specific format.
basic_string<_CharT>
_M_localize(basic_string_view<_CharT> __str, char __expc,
const locale& __loc) const
{
basic_string<_CharT> __lstr;
if (__loc == locale::classic())
return __lstr; // Nothing to do.
That just returns an empty string, which the caller then uses assuming it's
valid.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
2023-08-10 9:10 ` [Bug libstdc++/110968] " redi at gcc dot gnu.org
2023-08-10 13:18 ` redi at gcc dot gnu.org
@ 2023-08-10 13:19 ` redi at gcc dot gnu.org
2023-08-10 22:32 ` cvs-commit at gcc dot gnu.org
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: redi at gcc dot gnu.org @ 2023-08-10 13:19 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
--- a/libstdc++-v3/include/std/format
+++ b/libstdc++-v3/include/std/format
@@ -1634,7 +1634,8 @@ namespace __format
__wstr = _M_localize(__str, __expc, __fc.locale());
else
__wstr = _M_localize(__str, __expc, __loc.value());
- __str = __wstr;
+ if (!__wstr.empty())
+ __str = __wstr;
}
size_t __width = _M_spec._M_get_width(__fc);
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
` (2 preceding siblings ...)
2023-08-10 13:19 ` redi at gcc dot gnu.org
@ 2023-08-10 22:32 ` cvs-commit at gcc dot gnu.org
2023-08-11 0:03 ` cvs-commit at gcc dot gnu.org
2023-08-11 0:07 ` redi at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-08-10 22:32 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:
https://gcc.gnu.org/g:f48a5423964f72e2e1ba0ad6a14d9d1464a78bed
commit r14-3135-gf48a5423964f72e2e1ba0ad6a14d9d1464a78bed
Author: Jonathan Wakely <jwakely@redhat.com>
Date: Thu Aug 10 14:33:44 2023 +0100
libstdc++: Fix std::format for localized floats [PR110968]
The __formatter_fp::_M_localize function just returns an empty string if
the formatting locale is the C locale, as there is nothing to do. But
the caller was assuming that the returned string contains the localized
string. The caller should use the original string if _M_localize returns
an empty string.
libstdc++-v3/ChangeLog:
PR libstdc++/110968
* include/std/format (__formatter_fp::format): Check return
value of _M_localize.
* testsuite/std/format/functions/format.cc: Check classic
locale.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
` (3 preceding siblings ...)
2023-08-10 22:32 ` cvs-commit at gcc dot gnu.org
@ 2023-08-11 0:03 ` cvs-commit at gcc dot gnu.org
2023-08-11 0:07 ` redi at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-08-11 0:03 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:
https://gcc.gnu.org/g:15b3fc6c1c5296662d0ffd7d3cfb8b669421e5ea
commit r13-7706-g15b3fc6c1c5296662d0ffd7d3cfb8b669421e5ea
Author: Jonathan Wakely <jwakely@redhat.com>
Date: Thu Aug 10 14:33:44 2023 +0100
libstdc++: Fix std::format for localized floats [PR110968]
The __formatter_fp::_M_localize function just returns an empty string if
the formatting locale is the C locale, as there is nothing to do. But
the caller was assuming that the returned string contains the localized
string. The caller should use the original string if _M_localize returns
an empty string.
libstdc++-v3/ChangeLog:
PR libstdc++/110968
* include/std/format (__formatter_fp::format): Check return
value of _M_localize.
* testsuite/std/format/functions/format.cc: Check classic
locale.
(cherry picked from commit f48a5423964f72e2e1ba0ad6a14d9d1464a78bed)
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
` (4 preceding siblings ...)
2023-08-11 0:03 ` cvs-commit at gcc dot gnu.org
@ 2023-08-11 0:07 ` redi at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: redi at gcc dot gnu.org @ 2023-08-11 0:07 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|ASSIGNED |RESOLVED
--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Fixed for 13.3, thanks again
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-08-11 0:07 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-10 8:17 [Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f) gcc at pauldreik dot se
2023-08-10 9:10 ` [Bug libstdc++/110968] " redi at gcc dot gnu.org
2023-08-10 13:18 ` redi at gcc dot gnu.org
2023-08-10 13:19 ` redi at gcc dot gnu.org
2023-08-10 22:32 ` cvs-commit at gcc dot gnu.org
2023-08-11 0:03 ` cvs-commit at gcc dot gnu.org
2023-08-11 0:07 ` redi at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).