[Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f)

[Bug libstdc++/110968] New: format out of bounds read on format("{:05L}",-1.f)

[gcc at pauldreik dot se]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

            Bug ID: 110968
           Summary: format out of bounds read on format("{:05L}",-1.f)
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gcc at pauldreik dot se
  Target Milestone: ---

The following program:

#include <cstdio>
#include <format>

int main() {
    float v = -1;
    std::puts(std::vformat("{:05L}", std::make_format_args(v)).c_str());
}

generates an out of bounds read when compiled with gcc 13.2 (and current trunk,
as of 2023-08-10).

Link to reproducer: https://godbolt.org/z/PjeTsK89E

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Target Milestone|---                         |13.3
   Last reconfirmed|                            |2023-08-10
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Oh dear, I must have broken this function at some point while implementing
std::format:

      // Locale-specific format.
      basic_string<_CharT>
      _M_localize(basic_string_view<_CharT> __str, char __expc,
                  const locale& __loc) const
      {
        basic_string<_CharT> __lstr;

        if (__loc == locale::classic())
          return __lstr; // Nothing to do.

That just returns an empty string, which the caller then uses assuming it's
valid.

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
--- a/libstdc++-v3/include/std/format
+++ b/libstdc++-v3/include/std/format
@@ -1634,7 +1634,8 @@ namespace __format
                __wstr = _M_localize(__str, __expc, __fc.locale());
              else
                __wstr = _M_localize(__str, __expc, __loc.value());
-             __str = __wstr;
+             if (!__wstr.empty())
+               __str = __wstr;
            }

          size_t __width = _M_spec._M_get_width(__fc);

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:f48a5423964f72e2e1ba0ad6a14d9d1464a78bed

commit r14-3135-gf48a5423964f72e2e1ba0ad6a14d9d1464a78bed
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Thu Aug 10 14:33:44 2023 +0100

    libstdc++: Fix std::format for localized floats [PR110968]

    The __formatter_fp::_M_localize function just returns an empty string if
    the formatting locale is the C locale, as there is nothing to do. But
    the caller was assuming that the returned string contains the localized
    string. The caller should use the original string if _M_localize returns
    an empty string.

    libstdc++-v3/ChangeLog:

            PR libstdc++/110968
            * include/std/format (__formatter_fp::format): Check return
            value of _M_localize.
            * testsuite/std/format/functions/format.cc: Check classic
            locale.

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:15b3fc6c1c5296662d0ffd7d3cfb8b669421e5ea

commit r13-7706-g15b3fc6c1c5296662d0ffd7d3cfb8b669421e5ea
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Thu Aug 10 14:33:44 2023 +0100

    libstdc++: Fix std::format for localized floats [PR110968]

    The __formatter_fp::_M_localize function just returns an empty string if
    the formatting locale is the C locale, as there is nothing to do. But
    the caller was assuming that the returned string contains the localized
    string. The caller should use the original string if _M_localize returns
    an empty string.

    libstdc++-v3/ChangeLog:

            PR libstdc++/110968
            * include/std/format (__formatter_fp::format): Check return
            value of _M_localize.
            * testsuite/std/format/functions/format.cc: Check classic
            locale.

    (cherry picked from commit f48a5423964f72e2e1ba0ad6a14d9d1464a78bed)

[Bug libstdc++/110968] format out of bounds read on format("{:05L}",-1.f)

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110968

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Fixed for 13.3, thanks again