public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/2074] New: _IO_new_file_xsputn() in fileops.c not checking for EOF
@ 2005-12-20 20:28 jfardo at laurelnetworks dot com
  2010-05-10 23:46 ` [Bug manual/2074] " pasky at suse dot cz
  2010-05-11  0:51 ` pasky at suse dot cz
  0 siblings, 2 replies; 8+ messages in thread
From: jfardo at laurelnetworks dot com @ 2005-12-20 20:28 UTC (permalink / raw)
  To: glibc-bugs

In glibc 2.3.4, the function new_do_write() in libio/fileops.c returns an 
unsigned
value (an _IO_size_t). If the underlying write system call in new_do_write()
returns EOF (-1), new_do_write() will return 0xffffffff rather than -1.

The function IO_new_file_xsputn() in libio/fileops.c appears to have
2 problems if the call to new_do_write() returns 0xffffffff. Here's
the specific snippet of code from IO_new_file_xsputn():
      if (do_write)
        {
          count = new_do_write (f, s, do_write);
          to_do -= count;
          if (count < do_write)
            return n - to_do;
        }
      /* Now write out the remainder.  Normally, this will fit in the
	 buffer, but it's somewhat messier for line-buffered files,
	 so we let _IO_default_xsputn handle the general case. */
      if (to_do)
	to_do -= INTUSE(_IO_default_xsputn) (f, s+do_write, to_do);
    }
  return n - to_do;


If new_do_write() returns 0xffffffff, 'to_do' will actually
be incremented by 1. Also, since 'count' is an unsigned quantity,
the if statement 'if (count < do_write)' will evaluate to false,
and the code will incorrectly fall through to the call to
IO_default_xsputn().

-- 
           Summary: _IO_new_file_xsputn() in fileops.c not checking for EOF
           Product: glibc
           Version: 2.3.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: jfardo at laurelnetworks dot com
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=2074

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2014-06-13 14:41 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <bug-2074-131@http.sourceware.org/bugzilla/>
2012-04-12 19:05 ` [Bug manual/2074] _IO_new_file_xsputn() in fileops.c not checking for EOF aj at suse dot de
2012-04-12 19:10 ` aj at suse dot de
2012-04-30  1:11 ` mtk.manpages at gmail dot com
2014-02-16 18:25 ` jackie.rosen at hushmail dot com
2014-05-28 19:46 ` schwab at sourceware dot org
2014-06-13 14:41 ` fweimer at redhat dot com
2005-12-20 20:28 [Bug libc/2074] New: " jfardo at laurelnetworks dot com
2010-05-10 23:46 ` [Bug manual/2074] " pasky at suse dot cz
2010-05-11  0:51 ` pasky at suse dot cz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).