public inbox for gcc-cvs@sourceware.org help / color / mirror / Atom feed
From: Jonathan Wakely <redi@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org, libstdc++-cvs@gcc.gnu.org Subject: [gcc r13-7916] libstdc++: fix illegal pointer arithmetic in format [PR111102] Date: Wed, 27 Sep 2023 16:17:47 +0000 (GMT) [thread overview] Message-ID: <20230927161747.114E2385DC13@sourceware.org> (raw) https://gcc.gnu.org/g:183eea6029be2f6c9f416d6ffe751c469237ff2d commit r13-7916-g183eea6029be2f6c9f416d6ffe751c469237ff2d Author: Paul Dreik <gccpatches@pauldreik.se> Date: Thu Aug 24 11:43:43 2023 +0100 libstdc++: fix illegal pointer arithmetic in format [PR111102] When parsing a format string, the width is parsed into an unsigned short but the result is not checked in the case the format string is not a char string (such as a wide string). In case the parse fails, a null pointer is returned which is used for pointer arithmetic which is undefined behaviour. Signed-off-by: Paul Dreik <gccpatches@pauldreik.se> libstdc++-v3/ChangeLog: PR libstdc++/111102 * include/std/format (__format::__parse_integer): Check for non-null pointer. (cherry picked from commit dd4bdb9eea436bf06f175d8dbfc2190377455be4) Diff: --- libstdc++-v3/include/std/format | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libstdc++-v3/include/std/format b/libstdc++-v3/include/std/format index ec910f13a8e..3721f021afd 100644 --- a/libstdc++-v3/include/std/format +++ b/libstdc++-v3/include/std/format @@ -285,7 +285,8 @@ namespace __format for (int __i = 0; __i < __n && (__first + __i) != __last; ++__i) __buf[__i] = __first[__i]; auto [__v, __ptr] = __format::__parse_integer(__buf, __buf + __n); - return {__v, __first + (__ptr - __buf)}; + if (__ptr) [[likely]] + return {__v, __first + (__ptr - __buf)}; } return {0, nullptr}; }
reply other threads:[~2023-09-27 16:17 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230927161747.114E2385DC13@sourceware.org \ --to=redi@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ --cc=libstdc++-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).