From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 632C73865C26; Thu, 24 Aug 2023 12:45:14 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 632C73865C26
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1692881114;
	bh=j4TqwrbddVZfK+9aKSLNm2OIx8b8FMPnaKM5Lrd2/vQ=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=MemuoqIFHqHj0/idaYhE+12Ys0eoBpnKId0BGxMYvuoYgmaUoR2MzARHgMXfJFQ3D
	 lUAOp+OnWsOJ3EiRn/kME8g4ypx7IrJflSPAtIrUryZqku9MypeIE1MCa1egPkGx0e
	 wnzzVxwe4pwYhVph+uBy9fjySsWCObExrzu3wx9M=
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug libstdc++/111102] illegal pointer arithmetic invoked by
 std::format("L{:65536}",1)
Date: Thu, 24 Aug 2023 12:45:13 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: libstdc++
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 13.3
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-111102-4-QxKxU4ud5t@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-111102-4@http.gcc.gnu.org/bugzilla/>
References: <bug-111102-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D111102

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:dd4bdb9eea436bf06f175d8dbfc2190377455be4

commit r14-3457-gdd4bdb9eea436bf06f175d8dbfc2190377455be4
Author: Paul Dreik <gccpatches@pauldreik.se>
Date:   Thu Aug 24 11:43:43 2023 +0100

    libstdc++: fix illegal pointer arithmetic in format [PR111102]

    When parsing a format string, the width is parsed into an unsigned short
    but the result is not checked in the case the format string is not a
    char string (such as a wide string). In case the parse fails, a null
    pointer is returned which is used for pointer arithmetic which is
    undefined behaviour.

    Signed-off-by: Paul Dreik <gccpatches@pauldreik.se>

    libstdc++-v3/ChangeLog:

            PR libstdc++/111102
            * include/std/format (__format::__parse_integer): Check for
            non-null pointer.=