From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2181) id 114E2385DC13; Wed, 27 Sep 2023 16:17:47 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 114E2385DC13 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1695831467; bh=rJvYwki3dyINGFDvwbU+600DS453Jd01sVZvyFDYhMc=; h=From:To:Subject:Date:From; b=t0B2xdE5pIbXfuWL8ZXbIkm0pMYe46AZ9D2h/sF/jR2vU8nKXthOBotKfSqkUBaoK lbgIOd2xQv5qUfNrKGO3jXksSzQd7P9T7owk6WNRABoIWRIbGMefBGQyyJeH2J2XXa sL+Y04SA7zaKMYTHU5c7IE1Bmi5R22NoyyovhCM0= MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" From: Jonathan Wakely To: gcc-cvs@gcc.gnu.org, libstdc++-cvs@gcc.gnu.org Subject: [gcc r13-7916] libstdc++: fix illegal pointer arithmetic in format [PR111102] X-Act-Checkin: gcc X-Git-Author: Paul Dreik X-Git-Refname: refs/heads/releases/gcc-13 X-Git-Oldrev: 62c8ca3501a543ce6f0fb7a1a12e3f40bc75c8a7 X-Git-Newrev: 183eea6029be2f6c9f416d6ffe751c469237ff2d Message-Id: <20230927161747.114E2385DC13@sourceware.org> Date: Wed, 27 Sep 2023 16:17:47 +0000 (GMT) List-Id: https://gcc.gnu.org/g:183eea6029be2f6c9f416d6ffe751c469237ff2d commit r13-7916-g183eea6029be2f6c9f416d6ffe751c469237ff2d Author: Paul Dreik Date: Thu Aug 24 11:43:43 2023 +0100 libstdc++: fix illegal pointer arithmetic in format [PR111102] When parsing a format string, the width is parsed into an unsigned short but the result is not checked in the case the format string is not a char string (such as a wide string). In case the parse fails, a null pointer is returned which is used for pointer arithmetic which is undefined behaviour. Signed-off-by: Paul Dreik libstdc++-v3/ChangeLog: PR libstdc++/111102 * include/std/format (__format::__parse_integer): Check for non-null pointer. (cherry picked from commit dd4bdb9eea436bf06f175d8dbfc2190377455be4) Diff: --- libstdc++-v3/include/std/format | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libstdc++-v3/include/std/format b/libstdc++-v3/include/std/format index ec910f13a8e..3721f021afd 100644 --- a/libstdc++-v3/include/std/format +++ b/libstdc++-v3/include/std/format @@ -285,7 +285,8 @@ namespace __format for (int __i = 0; __i < __n && (__first + __i) != __last; ++__i) __buf[__i] = __first[__i]; auto [__v, __ptr] = __format::__parse_integer(__buf, __buf + __n); - return {__v, __first + (__ptr - __buf)}; + if (__ptr) [[likely]] + return {__v, __first + (__ptr - __buf)}; } return {0, nullptr}; }