[Bug libstdc++/59974] New: ostream crashes on large numbers under Windows

[Bug libstdc++/59974] New: ostream crashes on large numbers under Windows

[steve at sk2 dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

            Bug ID: 59974
           Summary: ostream crashes on large numbers under Windows
           Product: gcc
           Version: 4.6.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: steve at sk2 dot org

Created attachment 31972
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31972&action=edit
Test case

This is forwarded from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736946
and courtesy of Jeff Epler.

The attached program crashes when built with x86_64-w64-mingw32-g++ or
i686-w64-mingw32-g++.

The underlying cause is an assumption that snprintf never returns -1.  In fact,
on Windows, the platform snprintf returns -1 when the buffer is not big
enough, which leads to (A) calling alloca(-1) and (B) calling std::widen
with fin < st, either one of which is probably enough to lead to a
crash.

The patch shown below fixes several locations in libstdc++ where a
negative return value from snprintf was not properly handled.

The bug was filed against gcc 4.6.3 but it also applies to 4.8.2 and the
current 4.9 snapshot in Debian (20140122).

Note that the mingw-w64 can mask this bug by providing its own vsnprintf
implementation when building libstdc++.

Regards,

Stephen

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[steve at sk2 dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

--- Comment #1 from Stephen Kitt <steve at sk2 dot org> ---
Created attachment 31973
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31973&action=edit
Proposed patch

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
C99 says they return the number of characters that would have been written for
the return value of snprintf.  Now older versions of glibc (2.0.6) are broken
the same way mingw is broken.

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[steve at sk2 dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

--- Comment #3 from Stephen Kitt <steve at sk2 dot org> ---
Thanks for the quick feedback. It's not actually MinGW-w64 which is broken but
the Windows runtime library; MinGW-w64 provides its own C99-compliant
implementation of vsnprintf.

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[10walls at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

jon_y <10walls at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |10walls at gmail dot com

--- Comment #4 from jon_y <10walls at gmail dot com> ---
Created attachment 55291
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55291&action=edit
Rebased to the latest gcc git

Attached the rebased patch.

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-06-09
             Status|UNCONFIRMED                 |NEW

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
This should be submitted to the mailing lists for review.

Ideally, with copyright assignment from Stephen, or a DCO sign-off:
https://gcc.gnu.org/dco.html

If this is Stephen's first GCC contribution, then maybe we can accept it, as
it's only about 10 lines of logic.

I'd prefer if these changes were  guarded behind some #if check, so we don't
add unnecessary overhead on targets that don't need it. Or at the very least,
use __builtin_expect to predict that the branch for handling -1 is unlikely.

[Bug libstdc++/59974] ostream crashes on large numbers under Windows

[steve at sk2 dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974

--- Comment #6 from Stephen Kitt <steve at sk2 dot org> ---
The patches were written by Jeff Epler, not me, so I can't assign copyright or
sign off.