[Bug locale/29090] New: strfmon does not set E2BIG when buffer is too small

[Bug locale/29090] New: strfmon does not set E2BIG when buffer is too small

[kamilcukrowski at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29090

            Bug ID: 29090
           Summary: strfmon does not set E2BIG when buffer is too small
           Product: glibc
           Version: 2.35
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: locale
          Assignee: unassigned at sourceware dot org
          Reporter: kamilcukrowski at gmail dot com
  Target Milestone: ---

> The glibc version you are using

Arch Linux
x86_64-pc-linux-gnu
Linux leonidas 5.17.1-zen1-1-zen #1 ZEN SMP PREEMPT Mon, 28 Mar 2022 21:56:46
+0000 x86_64 GNU/Linu
ldd (GNU libc) 2.35
gcc (GCC) 11.2.0
LC_ALL=C
https://github.com/archlinux/svntogit-packages/blob/packages/glibc/trunk/PKGBUILD#L63

> A description of the problem and some way to replicate the problem

```
#include <errno.h>
#include <string.h>
#include <stdio.h>
#include <monetary.h>
int main() {
        char s[100];
        ssize_t err = strfmon (s, 100, "%n", 123.45);
        printf("ret=%zd errno=%d,%s\n", err, errno, strerror(errno));
        err = strfmon (s, 3, "%n", 123.45);
        printf("ret=%zd errno=%d,%s\n", err, errno, strerror(errno));
}
```

Just compiled with no options, results in:

```
ret=6 errno=0,Success
ret=-1 errno=0,Success
```

> If your bug relates to incorrect behaviour of standardised interfaces, a link to the appropriate section of the standard. 

In the second call to `strfmon`, the `maxsize=3` so there is not enough space
for `123.45` 6+1 character string. So errno should be set to `E2BIG`.

References
https://pubs.opengroup.org/onlinepubs/9699919799/functions/strfmon.html:

```
Otherwise, -1 shall be returned, the contents of the array are unspecified, and
errno *shall* be set to indicate the error.
```

and references https://man7.org/linux/man-pages/man3/strfmon.3.html :

```
Otherwise, it sets errno to E2BIG, returns -1, and the contents of the array is
undefined.
```

Yet errno is not set, it's `0`. I think this is a bug, it should be set to
E2BIG.

> Any analysis of the problem you have performed. 

The only place to `return -1` without setting `E2BIG` is from __printf_fp_l
here https://github.com/bminor/glibc/blob/master/stdlib/strfmon_l.c#L547 :

```
     done = __printf_fp_l (&f._sbf._f, loc, &info, &ptr);
      if (done < 0)
        return -1;
```

I tried to debug it and from the assembly as I undestand it I see that
`__printf_fp_l` returns `-1`. And `__printf_fp_l` will return `-1` in case of
`_IO_*put*` return `EOF`
https://github.com/bminor/glibc/blob/master/stdio-common/printf_fp.c#L78 and in
this case it does not set errno. As I see it, all other `return -1` paths from
`__printf_fp_l` either come from `malloc -> NULL` or from `ERANGE`, and the
ones that do not set errno come from `_IO_put/pad` calls. `_IO_str_jumps` from
https://github.com/bminor/glibc/blob/master/libio/strops.c also do not set
errno.

Thank you.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug locale/29090] strfmon does not set E2BIG when buffer is too small

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29090

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
I believe my vfprintf series fixes this:

[PATCH 20/26] stdio-common: Convert vfprintf and related functions to buffers
https://sourceware.org/pipermail/libc-alpha/2022-March/137154.html

Specifically, the new implementation does not use a temporary string buffer.
Instead, __printf_fp_l_buffer writes directly to the strfmon buffer that sets
E2BIG on overflow. We should add a test case for this, though.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug locale/29090] strfmon does not set E2BIG when buffer is too small

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29090

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.37
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from Andreas Schwab <schwab@linux-m68k.org> ---
Fixed in 2.37.

-- 
You are receiving this mail because:
You are on the CC list for the bug.